A formal Account of the Open Provenance Model

A Formal Account of the Open Provenance Model NATALIA KWASNIKOWSKA, Hasselt University and Transnational University of Limburg LUC MOREAU, University of Southampton JAN VAN DEN BUSSCHE, Hasselt University and Transnational University of Limburg

On the Web, where resources such as documents and data are published, shared, transformed, and republished, provenance is a crucial piece of metadata that would allow users to place their trust in the resources they access. The open provenance model (OPM) is a community data model for provenance that is designed to facilitate the meaningful interchange of provenance information between systems. Underpinning OPM is a notion of directed graph, where nodes represent data products and processes involved in past computations and edges represent dependencies between them; it is complemented by graphical inference rules allowing new dependencies to be derived. Until now, however, the OPM model was a purely syntactical endeavor. The present article extends OPM graphs with an explicit distinction between precise and imprecise edges. Then a formal semantics for the thus enriched OPM graphs is proposed, by viewing OPM graphs as temporal theories on the temporal events represented in the graph. The original OPM inference rules are scrutinized in view of the semantics and found to be sound but incomplete. An extended set of graphical rules is provided and proved to be complete for inference. The article concludes with applications of the formal semantics to inferencing in OPM graphs, operators on OPM graphs, and a formal notion of refinement among OPM graphs.

Categories and Subject Descriptors: H.1.m [Models and Principles]: Miscellaneous General Terms: Languages, Standardization, Theory, Verification Additional Key Words and Phrases: Provenance, temporal reasoning, World Wide Web ACM Reference Format: Natalia Kwasnikowska, Luc Moreau, and Jan Van Den Bussche. 2015. A formal account of the open provenance model. ACM Trans. Web 9, 2, Article 10 (May 2015), 44 pages.

DOI: http://dx.doi.org/10.1145/2734116

1. INTRODUCTION

In the context of the Web, provenance is information about entities, activities, and people involved in producing a resource (a piece of data, or any other thing) [Moreau et al. 2013]. This information can be used to form assessments about the quality, reliability, or trustworthiness of the resource. On the Web, data flows across multiple systems, implemented using different technologies and potentially hosted by different institutions. Hence, tracking the provenance of data in this context is particularly challenging, as it involves understanding flows of information in these different systems.

Luc Moreau’s work is funded in part by the EPSRC SOCIAM (EP/J017728/1) and ORCHID projects (EP/I011587/1), the FP7 SmartSociety project (600854), and the ESRC ebook project (ES/K007246/1).

Authors’ addresses: N. Kwasnikowska and J. Van den Bussche, Universiteit Hasselt, Agoralaan, gebouw D, 3590 Diepenbeek, Belgium; email: jan.vandenbussche@uhasselt.be; L. Moreau, School of Electronics & Computer Science, University of Southampton, Southampton SO17 1BJ, United Kingdom; email: L.Moreau@ecs.soton.ac.uk.

Permission to make digital or hard copies of part or all of this work for personal or classroom use is granted without fee provided that copies are not made or distributed for profit or commercial advantage and that copies show this notice on the first page or initial screen of a display along with the full citation. Copyrights for components of this work owned by others than ACM must be honored. Abstracting with credit is permitted.

To copy otherwise, to republish, to post on servers, to redistribute to lists, or to use any component of this work in other works requires prior specific permission and/or a fee. Permissions may be requested from Publications Dept., ACM, Inc., 2 Penn Plaza, Suite 701, New York, NY 10121-0701 USA, fax +1 (212) 869-0481, or permissions@acm.org. c 2015 ACM 1559-1131/2015/05-ART10 $15.00

DOI: http://dx.doi.org/10.1145/2734116

ACM Transactions on the Web, Vol. 9, No. 2, Article 10, Publication date: May 2015.

10

10:2

N. Kwasnikowska et al.

There is rich literature on provenance-tracking mechanisms in e-science [Simmhan et al. 2005], in databases [Buneman et al. 2008; Cheney et al. 2009], and in the Web [Moreau 2010b]. In the present article, however, we are concerned with providing logical foundations for provenance information that has already been collected.

Following a strong community momentum [Gil et al. 2010], there now exists a standard provenance interchange format, given by the PROV-DM W3C Recommendation [Moreau et al. 2013]. With PROV-DM in place, provenance information will increasingly be shared, copied, integrated, and compared. To perform these activities in a meaningful manner, it is important that we have a formal semantics for provenance information. Such a formal semantics will give us a formal criterion for when two provenance instances are equivalent, when one instance subsumes another one, or when one is the refinement of another one. In this article, we present a proposal for such a semantics.

We take a logic-based approach and view a provenance instance as a logical theory.

Our approach is temporal: the axioms of the theory state inequalities on temporal variables. These variables represent the time points of creation of artifacts, of beginning and ending of processes, and of usage of artifacts by processes. A model of a provenance instance is an assignment of concrete time points to variables that satisfies the axioms of the theory. We can then simply say that two provenance instances are equivalent if they have the same models, or we can define appropriate notions of refinement or subsumption in terms of logical implications among theories.

We develop our work in the context of the open provenance model (OPM) [Moreau et al. 2011], which has been very popular as a precursor to the PROV-DM standard [Missier and Goble 2011; Miles 2011; Groth and Moreau 2011; Freitas et al. 2011; Lim et al. 2011; Kwasnikowska and Van den Bussche 2008]. OPM is more lightweight than PROV-DM and thus is a more tractable data model for formalization. At the same time, the essential elements of provenance instances, namely entities and activities, and the relationships that connect entities or activities with other entities or activities, are present in OPM as well as in PROV-DM; only the terminology is a little bit different.

As a matter of fact, our work begins with a critique of OPM, enhancing it with a number of improvements, which have also been adopted by PROV-DM. In OPM, provenance instances are represented as graph structures. In the setting of our improved OPM model, we make the following contributions: (1) Our main result (Theorem 4.7) provides a direct, clear, and concise characterization of the logical consequences of an OPM graph in terms of a comprehensive list of patterns that may be matched against the graph.

(2) Our characterization semantically justifies the inference rules that are part of OPM; one of the main corollaries of our main result is a completeness theorem for these inference rules (Corollary 4.13).

(3) We clarify the effect of cycles in OPM graphs by characterizing the equalities on temporal variables that such cycles entail (Proposition 5.10).

(4) Based on our formal semantics, we propose a notion of refinement among OPM graphs (Section 6.1).

(5) We define a powerful operation on OPM graphs, called proper and legal merge-renaming, and show that this operation always results in a refinement (Theorem 6.9).

Since an initial draft of this article was circulated [Kwasnikowska et al. 2010], the temporal inequalities that we propose here have become part of the W3C PROVCONSTRAINTS Recommendation [Cheney et al. 2013]. Moreover, our notions of interpretation and model have been adopted in the W3C PROV-SEM Working Draft [Cheney 2013]. Thus, many ideas of the present work have percolated into the PROV standard, ACM Transactions on the Web, Vol. 9, No. 2, Article 10, Publication date: May 2015.

A Formal Account of the Open Provenance Model

10:3

so the preceding list of contributions applies to PROV as well. A detailed discussion of how our results can be applied to PROV will be given in Section 8.

The formalism introduced in this work is amenable to effective implementation, as has been demonstrated by the implementation of several PROV validators. An online PROV validator developed in Java [Moreau et al. 2014] is available online (provenance. ecs.soton.ac.uk). The validator prov-check developed by Groth1 retrieves the patterns from our Theorem 1 by means of SPARQL queries against an RDF representation of the PROV instance. Cheney and Cresswell2 have made an implementation in Prolog.

Moreover, based on an earlier draft of this article [Kwasnikowska et al. 2010], Dey et al. [2013] have implemented tools (using Datalog) to generate temporal models for OPM graphs as formally defined in this article.

To conclude, we would like to stress that a temporal approach is only one possible approach to give a semantics to OPM graphs. Still, it is an approach that follows naturally from the informal explanations of dependencies in OPM graphs given in the reference specification. In addition, temporal ordering of events is a fundamental approach already known from the distributed systems literature [Lamport 1978; Mattern 1989; Tel 1994]. It remains an interesting topic for future research to explore alternative approaches, such as using Halpern and Pearl’s notions of actual cause and explanation [Halpern and Pearl 2005] as suggested by Cheney [2010]. We will discuss Cheney’s paper together with other related work.

This article is organized as follows. We begin in Section 2 by reviewing the basic features of OPM, showing the need for a formal semantics. Section 3 then formally defines OPM graphs and their temporal interpretation. In Section 4, the notion of OPM inference, which allows new edges to be inferred, is defined and characterized with respect to the temporal semantics. Given that OPM graphs are meant to be exchanged and manipulated to address provenance use cases, we formalize common operations over OPM graphs in Section 5. From the outset, it was envisaged that relations between OPM graphs, such as refinement, would be of value to reasoners; however, no precise definition of refinement has been proposed so far. This problem is tackled in Section 6, where a purely semantic definition of refinement is proposed, based on the temporal semantics. The notion of account is formalized in Section 7.

Related work specific to OPM is discussed in Section 8; that section also presents an explicit mapping of our temporal axioms into PROV-CONSTRAINTS. Conclusions and topics for further research are presented in Section 9.

2. OPM: GRAPHS AND INFERENCE RULES

The OPM reference specification defines an OPM graph as a directed, edge-labeled graph. Nodes can be of two types: artifacts3 and processes. Accordingly, there are four types of edges: generated-by, used, derived-from, and informed-by, depending on the type of their source and destination: Type of Source artifact process artifact process

Type of Destination process artifact artifact process

Type of Edge generated-by used derived-from informed-by

1 https://github.com/pgroth/prov-check.

2 checker.pl:

https://github.com/jamescheney/prov-constraints. the context of the Web, an artifact would be regarded as a Web resource [Jacobs and Walsh 2004] in a given state. A process is an execution of a program, whether it is a service on the Web or a client-side script, running in a browser.

3 In

ACM Transactions on the Web, Vol. 9, No. 2, Article 10, Publication date: May 2015.

10:4

N. Kwasnikowska et al.

Fig. 1. OPM graph for an e-shop order.

Generated-by and used-edges are labeled with so-called roles, which can be likened to field names in records or to parameter names in procedures.4 Example 2.1. Let us consider an e-shop over the Web, making a variety of e-material available to its customers but also acting as a marketplace for products sold by third parties. Figure 1 shows an OPM graph with three processes: Take Order, Deliver, and Third-Party Process. The figure also shows seven artifacts: billing address, order, invoice info, delivery request, invoice, e-book, and toy. The graph contains provenance information about an e-book and a toy that have been bought from an e-shop. As soon as the order is taken, a delivery request is generated. The billing address is provided separately; once provided, the information necessary to make an invoice is sent to the delivery department as well.5 Upon receiving the delivery request and matching invoice information, the delivery department generates a paper invoice that is sent to the customer; furthermore, an access code for the e-book is made available through the Web transaction. Toys are delivered by a third party. Here the information is less detailed, simply because the observer generating it does not have access to the thirdparty system; all that is given is that the third party was influenced by the taking of the original order, and that the toy derives from the same order. Note that there is no derived-from edge from the delivery request to the billing address, as the former may already have been generated before the latter was provided.

4 In

the reference specification, informed-by is called triggered-by instead. The reference specification also speaks of accounts, which we defer to Section 7. It further introduces agents and their incident controlledby edges, which are the sole feature of OPM that we ignore in the present work, as OPM does not allow provenance of agents to be expressed, and therefore agents have no bearing on the temporal interpretation of graphs.

5 The example is slightly contrived to allow us to illustrate some subtle points of the semantics of OPM graphs later on.

ACM Transactions on the Web, Vol. 9, No. 2, Article 10, Publication date: May 2015.

A Formal Account of the Open Provenance Model

10:5

Formally, we have the following.

Definition 2.2 (OPM graph, first definition). An OPM graph is a structure (Art, Proc, Roles, GeneratedBy!, Used!, DerivedFrom, InformedBy), where —Art and Proc are two disjoint finite sets of elements called artifacts and processes, respectively; —Roles is a finite set of elements called roles; —GeneratedBy! ⊆ Art × Roles × Proc; —Used! ⊆ Proc × Roles × Art; —DerivedFrom ⊆ Art × Art; and —InformedBy ⊆ Proc × Proc.

Artifacts and processes are collectively referred to as the nodes of an OPM graph.

Nodes are identifiers, serving as local references; the actual value of the identifiers is not important, as all information contained in an OPM graph is given by its structure.

Nevertheless, when the node identifiers refer to actual objects on the Web, or when different parties want to compare or merge different OPM graphs, some care has to be taken in agreeing on the chosen identifiers. This situation is very similar to URIs in RDF and Linked Data on the Web. The elements of GeneratedBy! ∪ Used! are called precise edges, and the elements of DerivedFrom ∪ InformedBy are called imprecise edges; all together, they are called r edges. Precise edges are of the form (x, r, y) and are additionally denoted as x → y, or, ! when it is not important to know r, as x → y. Imprecise edges (x, y) are denoted simply as x → y.

Note how the preceding definition allows for multiple precise used-edges between a same process-artifact pair, with multiple roles. They would indicate that during its lifetime, a process used a same artifact several times with different roles.

Remark 2.3. We do not specify that roles are disjoint from artifacts and processes because we do not need that assumption. This is not to say, however, that we attach any importance to an artifact or process that may appear as a role. If an identifier of a node also appears as a role, the two intents of this identifier—one as node, and one as role—will never be confused in our theory, as we will never compare roles with nodes.

2.1. Informal Meaning of Edges

OPM is not some kind of programming language, and OPM graphs are neither some kind of programs. Indeed, provenance information is not restricted to computer programs. Moreover, if one must insist on a programming analogy, then OPM graphs can better be thought of as representing execution traces of programs, without any further information about the program itself.

Indeed, the reference specification makes clear that edges in an OPM graph indicate causal dependencies. Specifically, the specification provides the following informal meanings: Edge Type

Edge

used

P→A

generated-by informed-by derived-from

A→ P P2 → P1 A2 → A1

!

!

Meaning P could not have completed without A. A could not have existed without P. P2 could not have completed without P1 .

A2 could not have existed without A1 .

ACM Transactions on the Web, Vol. 9, No. 2, Article 10, Publication date: May 2015.

10:6

N. Kwasnikowska et al.

Thus, for example, in Figure 1, we see that “Third-Party Process” must have ended after “Take Order” was started; that “toy” must have been produced after “order” was given; that “e-book” must have been produced after “Deliver” started; and that “Deliver” must have ended after the “invoice info” was produced.

2.2. Inference Rules

Interpreting edges in an OPM graph as causal dependencies, the OPM reference specification also includes four inference rules that infer new dependencies from the given dependencies in an OPM graph. Concretely, the rules infer new, so-called multistep ∗ edges, denoted as X → Y , of each of the four possible types. The rules are recursive and essentially based on the transitive closure of derived-from edges. Let A, B, C be artifacts, and let P and Q be processes: !

Basis. For every existing edge X → Y or X → Y , we can infer the trivial multistep ∗ edge X → Y . ∗ ∗ ∗ Derived-from. If we can infer A → B and B → C, then we can also infer A → C. ∗ ∗ ∗ Generated-by. If we can infer A → B and B → P, then we can also infer A → P. ∗ ∗ ∗ Used. If we can infer P → A and A → B, then we can also infer P → B. ∗ ∗ ∗ Informed-by. If we can infer P → A and A → Q, then we can also infer P → Q. For example, in Figure 1, we can infer multistep edges from “e-book” to “order,” from “Deliver” to “billing address,” and from “Deliver” to “Take Order,” among others. Note that we cannot infer a multistep edge from “delivery request” to “billing address.”

Remark 2.4. Note that there are no further rules such as “from A → P → B infer ∗ ∗ A → B” or “from P → Q → R infer P → R.” We will see in Remark 4.3 that both of these inferences are unsound.

2.3. OPM: A Critique from a Formal Viewpoint

Although the edges in an OPM graph have a clear informal meaning, a formal semantics is lacking. By developing such a formal semantics, we are able to address the following open issues, pertaining to edges, but also to other concepts underpinning OPM: (1) A formal semantics can define what is correct reasoning in an OPM graph (cf.

Remark 2.4) and would allow us to assess whether the inference rules are sound, or complete.

(2) Furthermore, there seems to be no good reason why multistep edges can only be inferred but cannot be asserted in the graph to begin with. For example, at a coarser level of granularity, it may be that only multistep information is available without that the steps in between can be detailed. This issue was brought up by the “OPM community,”6 but it has not been investigated so far.

In this respect, the distinction between imprecise edges and multistep edges is unclear. For example, in Figure 1, the edges “toy” to “order” and “Third-Party Process” to “Take Order” have a multistep flavor already. Conversely, one may wonder why there are no precise derived-from (or informed-by) edges, and why there are no imprecise used or generated-by edges. In general, the distinction between precise edges (edges carrying roles) and imprecise edges has been questioned during the development of OPM.7 6 See

discussions in http://twiki.ipaw.info/bin/view/OPM/WorkInProgressV1pt1.

7 http://twiki.ipaw.info/bin/view/Challenge/FirstOPMWorkshopMinutes.

ACM Transactions on the Web, Vol. 9, No. 2, Article 10, Publication date: May 2015.

A Formal Account of the Open Provenance Model

10:7

(3) Time is regarded as a fundamental concept of OPM (and hence was voted to be kept in the OPM reference specification8 ), but the manner in which time contributes to the essence of OPM has not been established formally.

(4) OPM graphs containing cycles of derived-from edges are not legal according to the OPM reference specification. OPM also defines some operations over graphs, but some, such as union, are known to be capable of forming cycles, and hence leading to graphs that are not legal. Whether the acyclic nature of graphs should be mandated by default, or whether it can be inferred, and the conditions under which it holds is an open problem.

(5) An account is a construct by which multiple descriptions of execution can coexist in a same OPM graph. The reference specification indicates that accounts may be related according to some relations and suggests a notion of refinement. This notion again has not been formalized.

In the next two sections, we will address these gaps by proposing an extended model that allows imprecise edges asserted in a graph for all four types of edges, proposing a formal semantics that allows a rigorous notion of inference, and investigating sound and complete inference in OPM graphs. Our extended model allows precise derivedfrom edges, leading to a new notion of “use–generate–derive” triangles in OPM graphs that show a tight relation between a derivation and the process responsible for the derivation.

We believe that the semantic distinction between imprecise and precise edges is important. Imprecise specifications relieve the provenance asserter of the extra burden of having to give precise derivations when these are not available or are not important for the application at hand; at the same time, when precise information is available and important, our theory allows the understanding of the extra knowledge that is provided.

3. OPM GRAPHS AND THEIR TEMPORAL SEMANTICS

We begin with an improved definition of OPM graph where both precise and imprecise edges of all four types are allowed, with the exception of precise informed-by edges.9 Definition 3.1 (OPM graph, improved definition). An OPM graph is a structure (Art, Proc, Roles, GeneratedBy!, Used!, DerivedFrom!, GeneratedBy, Used, DerivedFrom, InformedBy), where —Art and Proc are two disjoint finite sets of elements called artifacts and processes, respectively; —Roles is a finite set of elements called roles; —GeneratedBy! ⊆ Art × Roles × Proc; —Used! ⊆ Proc × Roles × Art; —DerivedFrom! ⊆ Art × Roles × Art; —GeneratedBy ⊆ Art × Proc; —Used ⊆ Proc × Art; 8 http://twiki.ipaw.info/bin/view/OPM/ChangeProposalMoveTimeToProfile.

9 We

could have allowed precise informed-by edges, but in our current approach they would have exactly the same semantics as imprecise ones, which is why we omit them. It is an interesting open problem whether there is a natural approach by which precise informed-by edges can be given a more specific semantics than imprecise ones.

ACM Transactions on the Web, Vol. 9, No. 2, Article 10, Publication date: May 2015.

10:8

N. Kwasnikowska et al.

Fig. 2. Example of an OPM graph according to the improved definition.

—DerivedFrom ⊆ Art × Art; and —InformedBy ⊆ Proc × Proc.

In extension of our original terminology, the elements of GeneratedBy! ∪ Used! ∪ DerivedFrom! are called precise edges, and the elements of GeneratedBy ∪ Used ∪ DerivedFrom ∪ InformedBy are called imprecise edges; all together, they are called edges.

For future use, we introduce the following notation. When the distinction between precise and imprecise derived-from edges is of no consequence, we use the following set to refer to all derived-from edges of an OPM graph: DerivedEdges = DerivedFrom ∪ {(A, B) | (A, r, B) ∈ DerivedFrom!}.

Example 3.2. The graph shown in Figure 2 extends the graph of Figure 1 with some new features allowed by the improved definition. All derived-from edges involved in the making of the invoice and e-book have now become precise. Moreover, we have added an imprecise used-edge from “Third-Party Process” to “order” and an imprecise generated-by edge from “toy” to “Take Order.”

3.1. Legality

The OPM reference specification defines a notion of legal graph as a directed graph without cycles in the derived-from edges, in which each artifact is generated by at most one process. It turns out that cycles in the derived-from edges do not strictly need to be forbidden; we will discuss this issue in more detail in Section 5.2. On the other hand, we can refine the notion of legality to take advantage of the new possibility of precise derived-from edges. This leads to the following.

Definition 3.3 (Legal OPM graph). An OPM graph is called legal if —for each artifact A, there is at most one process P with a precise generated-by edge !

A → P; and ACM Transactions on the Web, Vol. 9, No. 2, Article 10, Publication date: May 2015.

A Formal Account of the Open Provenance Model

10:9

Fig. 3. A use–generate-derive triangle (A, B, P, r). r

—for each precise derived-from edge A → B, there is a process P with precise edges ! r A → P and P → B, for the same role r. r

!

r

A configuration (A, B, P, r) with edges A → B, A → P, and P → B, is called a use–generate–derive triangle, or simply triangle for short (Figure 3). To denote that a use–generate–derive triangle (A, B, P, r) occurs in some given OPM graph G, we use the notation G (A, B, P, r).

A use–generate–derive triangle is the graphical syntax introduced to state in OPM that B was not merely used by P but was specifically used as part of the creation of A. Thus, the common role r labeling both the usage of B by P and the derivation of A from B is used to express that this usage of B has affected the output A. Note that P might also use B in additional roles different from r, which would correspond to usages not relevant to the generation of A. The generated-by edge from A to P must be precise but is not required to be labeled r, thus allowing more freedom for producers of OPM graphs. The generated-by edge must still be precise, failing which we would not be certain that it was P itself that generated A. This indeed will be the distinction in semantics between precise and imprecise generated-by edges introduced in Definition 3.6.

Example 3.4. Figure 2 contains a number use–generate–derive triangles, notably: —Two triangles involving the process “Deliver”: —(invoice, invoice info, Deliver, inv); —(e-book, delivery request, Deliver, req).

—three more involving the process “Take Order”: —(invoice info, billing address, Take Order, addr); —(invoice info, order, Take Order, order); —(delivery request, order, Take Order, order).

In this article, unless otherwise explicitly stated, we only consider legal OPM graphs.

Whenever we refer to a single OPM graph G, we use the names defined in this section to refer to the different constituents of the OPM graph. If we handle more than one OPM graph—for instance, graphs G and H—we use superscripts G and H to distinguish their respective constituents. We extend this convention to other concepts related to OPM graphs.

3.2. Temporal Models for OPM Graphs

The informal meaning of OPM edges, given in Section 2, is temporal in nature. To formalize these statements, we need to refer to such temporal events as the production of an artifact, and the start and completion of a process. To better exploit precise useedges and use–generate–derive triangles, we also refer to the use of an artifact by a ACM Transactions on the Web, Vol. 9, No. 2, Article 10, Publication date: May 2015.

10:10

N. Kwasnikowska et al.

process as a temporal event. This leads us to introduce the formal notion of temporal model, which we develop in this section.10 We start with the notion of a temporal interpretation of a legal OPM graph: an assignment of time points to processes, artifacts, and precise used-edges, specifically:11 —for each artifact A, its creation time, denoted by create(A); —for each process P, its beginning and ending times, denoted by begin(P) and end(P), respectively; and r —for each precise used-edge P → A, the time when P used A in role r, denoted by use(P, r, A).

To make this formal, we fix some OPM graph G for the remainder of this section. We define the set of temporal variables of G, denoted by Vars(G), as follows: Vars(G) = {create(A) | A ∈ Art} ∪ {begin(P), end(P) | P ∈ Proc} ∪ {use(P, r, A) | (P, r, A) ∈ Used!}.

We then define the following.

Definition 3.5. A temporal interpretation of G is a triple (T , ≤, τ ), where —T is a set, we call its elements time points; —≤ is a partial order on T ; and —τ is a mapping from Vars(G) to T .

When no confusion can arise, we omit T and ≤ from the notation and simply denote a temporal interpretation by τ .

Not every temporal interpretation makes sense as a temporal model of G. Indeed, to reflect the dependencies specified in G, the interpretation should satisfy various constraints reflecting these dependencies.

To define these constraints formally, we define an inequality over G as a syntactical expression of the form u v, with u, v ∈ Vars(G). Thus, inequalities are simple formulas. By a trivial inequality, we mean an inequality of the form u u. We are now ready to define the set of constraints expressed by a legal OPM graph.

Definition 3.6. The temporal theory of G, denoted by Th(G), is the set consisting of all inequalities stated in the axioms listed in Table I.12 Axioms 1 through 3 are clear; Axioms 4 through 7 are a verbatim formalization of the informal meaning of edges from the OPM reference specification, recalled in Section 2. The eighth and final axiom, the “triangle axiom,” corresponds to the intended usage of OPM by which a precise derived-from edge in a use–generate–derive triangle (A, B, P, r) in G is not redundant but expresses exactly that P needed to read B in role r before it could generate A. Example 3.7. In Figure 2, the precise generated-by edge from “e-book” to “Deliver” yields the constraint that the e-book access code was made available before the Deliver 10 The

reference specification also allows OPM graphs to be explicitly decorated with time points, but this is optional; thus, in this article, we focus on the semantics of “blank” graphs: graphs initially without temporal decorations. Indeed, the temporal models developed in this section correspond to all consistent ways in which such a blank OPM graph can be decorated.

11 One may wonder why precise generated-by edges do not get a time point. But, as a matter of fact, they do. r For each precise generated-by edge A → P, we indeed have a time point create(A). Since the OPM graph is legal, there can be at most one precise edge emanating from A, so we do not need to specify r and P. 12 In mathematical logic, a theory is sometimes (but not always) defined as a set of formulas closed under logical implication. Here it is just a set of formulas, not necessarily closed in this way.

ACM Transactions on the Web, Vol. 9, No. 2, Article 10, Publication date: May 2015.

A Formal Account of the Open Provenance Model

10:11

Table I. The Inequalities Making Up the Temporal Theory of an OPM Graph AX 1: for each process P, the inequality begin(P) end(P); !

AX 2: for each precise generated-by edge A → P in G, the inequalities begin(P) create(A) end(P); r AX 3: for each precise used-edge P → A in G, the three inequalities begin(P) use(P, r, A), use(P, r, A) end(P), and create(A) use(P, r, A); AX 4: for each imprecise derived-from edge A → B in G, the inequality create(B) create(A); AX 5: for each imprecise generated-by edge A → P in G, the inequality begin(P) create(A); AX 6: for each imprecise used-edge P → A in G, the inequality create(A) end(P); AX 7: for each informed-by edge P → Q in G, the inequality begin(Q) end(P); AX 8: for each G (A, B, P, r), the inequality use(P, r, B) create(A).

Table II. Two Temporal Models for the Graph Shown in Figure 3 τ1

Variable create(B) begin(P) use(P, r, B) create(A) end(P)

τ2

Value 1 2 3 4 5

Variable create(B) begin(P) use(P, r, B) create(A) end(P)

Value 1 1 1 1 1

process completed. In contrast, the imprecise generated-by edge from “toy” to “Take Order” only yields that the toy was delivered by the third party after the Take Order process started. The use–generate–derive triangle (e-book, delivery request, Deliver, req) also yields that the delivery request was received by the Deliver process before the e-book access code was communicated.

We finally define the temporal models of G as follows. Naturally, a temporal interpretation τ is said to satisfy an inequality u v if τ (u) ≤ τ (v).

Definition 3.8. A temporal interpretation τ of G is a temporal model of G, denoted by τ |= Th(G), if it satisfies all inequalities from Th(G).

Example 3.9. Consider the small OPM graph G shown in Figure 3. Let us use natural numbers with their natural ordering as time points. Then the two interpretations τ1 and τ2 , presented in Table II, are temporal models of G. Temporal model τ2 , which maps all temporal variables to the same time point, might be generated by a very coarse clock.

Many temporal interpretations of G, however, are not temporal models of G. If, for example, we would modify τ1 to τ1 by setting τ1 (end(P)) = 0, then Axiom 1 would be violated. Likewise, if we would modify τ2 to τ2 by setting τ2 (use(P, r, B)) = 0, then Axiom 3 would be violated. In addition, if we would modify τ1 to τ1

by setting τ1

(create(A)) = 0, then we would violate Axioms 2 and 8.

Example 3.10. For another example, consider an OPM graph with two artifacts A ! r and B and one process P, with edges A → P → B. Then both τ1 and τ2 , defined as follows, are models of the graph: τ1 create(B) begin(P) use(P, r, B) create(A) end(P)

1 2 3 4 5

τ2 begin(P) create(A) create(B) use(P, r, B) end(P)

1 2 3 4 5

In model τ1 , P uses B before creating A, but in model τ2 , B does not yet exist when A is created. Note that B does not have a generated-by edge, so the graph does not specify which process generated B. ACM Transactions on the Web, Vol. 9, No. 2, Article 10, Publication date: May 2015.

10:12

N. Kwasnikowska et al.

Example 3.11. Consider a graph with three processes P, Q, and R and edges P → Q → R. Then both τ1 and τ2 , defined as follows, are models of the graph: τ1 begin(R) end(R) begin(Q) end(Q) begin(P) end(P)

1 2 3 4 5 6

τ2 begin(P) begin(Q) end(P) begin(R) end(Q) end(R)

1 2 3 4 5 6

Example 3.12. For a final example, consider an OPM graph with two artifacts Aand B and nothing else (no edges either). Then any possible temporal interpretation qualifies as a model. In particular, in some models τ, we have τ (create(A)) < τ (create(B)); in other models, we have τ (create(B)) < τ (create(A)); and still in others, we have τ (create(A)) = τ (create(B)). This is because the OPM graph does not impose any constraints due to the absence of any edge between A and B. 4. INFERENCE IN OPM GRAPHS

The axioms of Definition 3.6 allow us to obtain a number of inequalities over an OPM graph’s variables. These inequalities logically imply further inequalities. For a trivial example, in an OPM graph with derived-from edges A → B → C, Axiom 4 gives the inequalities create(C) create(B) and create(B) create(A), which logically imply the further inequality create(C) create(A).

Formally, we define the following.

Definition 4.1. Let G be a legal OPM graph, and let u, v ∈ Vars(G). The inequality u v is a logical consequence of G, denoted by Th(G) |= u v, if u v is satisfied in every temporal model of G. A general example of logical consequence is provided by the following lemma and proof.

LEMMA 4.2. Let G be a legal OPM graph with artifacts A and B and a precise edge r A → B for some role r. Then Th(G) |= create(B) create(A).

Before proving this lemma, we note that Axiom 4 is almost exactly the same, except that it is stated for an imprecise derived-from edge. Thus, the present lemma shows that the same constraint holds for precise derived-from edges. This constraint did not need to be explicitly given as an axiom because it already logically follows from the given axioms. r

!

PROOF. Since G is legal, there exists a process P in G with edges P → B and A → P. Let τ be a temporal model of G. By Axiom 3, we have τ (create(B)) ≤ τ (use(P, r, B)).

By Axiom 2, we have τ (use(P, r, B)) ≤ τ (create(A)). We conclude that τ (create(B)) ≤ τ (create(A)) as desired.

Remark 4.3. Model τ2 from Example 3.10 shows that create(B) create(A) is not a logical consequence of a graph with edges A → P → B. Since create(B) create(A) is the semantics of an (imprecise) derived-from edge (Axiom 4), this explains the unsoundness of the first inference considered in Remark 2.4. Similarly, model τ2 from Example 3.11 shows that the begin(R) end(P) is not a logical consequence of a graph with edges P → Q → R, thus explaining the unsoundness of the second inference considered in Remark 2.4.

ACM Transactions on the Web, Vol. 9, No. 2, Article 10, Publication date: May 2015.

A Formal Account of the Open Provenance Model

10:13

A fundamental problem is to know exactly which inequalities logically follow from a given OPM graph. This problem has many applications. For example, if the provenance information for the U.S. National Climate Assessment is recorded carefully [Tilmes et al. 2013], we may want to make sanity checks such as inferring that some source data must have been generated before various conclusions were drawn from them.

It is well known that an inequality u w can be inferred from Th(G) by using repeated applications of the rule of transitivity: “from u v and v w we infer u w”.13 Such an approach is unsatisfactory, however, as it is hard to relate the newly inferred inequalities to nodes and edges in the graph.

The inference given by Lemma 4.2 provides a case in point. When the user asks why create(B) create(A) must hold, pure reasoning by inequalities can only present the following proof: create(B) use(P, r, B) create(A)

by Axiom 3

by Axiom 2.

In contrast, a much more direct justification for create(B) create(A) is the presence r of the edge A → B in the graph.

Indeed, we show in Section 4.2 that it is always possible to provide such direct justifications by performing temporal inference in a purely graphical manner. We prove in Theorem 4.7 that every possible logical consequence can be directly inferred from the OPM graph by looking for a fixed set of patterns in the graph.

4.1. Edge-Inference Rules

The cornerstone of our graph-based inference of inequalities is provided by the four original OPM inference rules already recalled in Section 2. We revisit them here in full detail, at the same time extending them to better exploit the possible presence of precise edges. Inferred edges will prove to play an important role in graphical patterns that we introduce to infer inequalities. Moreover, we establish that inference of edges is the only action that we need to perform to infer inequalities that do not involve usevariables. (For inequalities involving use-variables, patterns more complicated than a single edge have to be matched in the graph.) We thus provide a justification for the edge inferences introduced in the OPM reference specification.

We first argue for the inference of edges at the intuitive level, based on following chains of derived-from edges. Then we define edge inference formally in Definition 4.5.

Suppose that there is a chain of derived-from edges in G (which can be either precise or imprecise) that starts in an artifact A and ends in an artifact C. We denote this by A C. Formally, relation between two artifacts is nothing else than the transitive closure of DerivedEdges. Since A has been indirectly derived from C, we can think of A C as an inferred edge, as illustrated in Figure 4(a).

Next we show how to infer generated-by edges. Suppose that we have artifacts A and B with A B and a generated-by edge from B to a process P in G, either a precise ! edge B → P or an imprecise edge B → P. Then A has been indirectly generated by P, and we can infer an edge A P, as illustrated in Figure 4(b).

We can infer used-edges as well. Suppose that we have artifacts Aand B with A B. !

In addition, there is a used-edge from a process P to A in G, either precise P → A or imprecise P → A. Then P has indirectly used B, and we can infer an edge P B, as illustrated in Figure 4(c). Moreover, we can also infer a used-edge in the following situation. Suppose that we again have A B, but now in combination with a precise 13 For a set of inequalities

and an inequality ϕ, ϕ is a logical consequence of if and only if ϕ can be inferred from by using transitivity. Ullman [1989] presents a self-contained proof for a slightly more general case.

ACM Transactions on the Web, Vol. 9, No. 2, Article 10, Publication date: May 2015.

10:14

N. Kwasnikowska et al.

Fig. 4. Inference of derived-from (a), generated-by (b), used (c)–(d), and informed-by (e)–(f) edges. The bold edges are newly inferred. The edges labeled by “(!)” may be either precise or imprecise. !

edge A → P in G. Since A was precisely generated by P, but A has also been indirectly derived from B, we can conclude that P has indirectly used B. Again, we can infer P B, which we show in Figure 4(d).

Finally, to infer informed-by edges, we can reason as follows. Suppose, for some processes P and Q and an artifact A, that we have edges P A and A Q. Then, A represents information that flowed from Q to P, and we can infer an edge P Q, as illustrated in Figure 4(e). Moreover, an informed-by edge can also be inferred in the following case. Suppose that we again have A Q, but now in combination with a ! precise edge A → P in G. Since A was directly generated by P but A was also indirectly generated by Q, we can conclude that P was somehow influenced by Q. Again, we can infer P Q, which we show in Figure 4(f).

There are also trivial inferences for all types of edges, to the effect that an edge that is already present in the graph can always be inferred.

Example 4.4. In Figure 2, we can now see that the informed-by edge from “ThirdParty Process” to “Take Order” is redundant in the sense that it can already be inferred using the precise edge from “toy” to “Third-Party Process” and the imprecise edge from “toy” to “Take Order” (Figure 4(f)). Likewise, the imprecise used edge from “Third-Party Process” to “order” is redundant in the sense that it can be inferred now using the edge from “toy” to “order” (Figure 4(d)).

The preceding discussion is formalized in the following definition. We present the rules in a standard notation used in formal logic, where for each rule the premises are stated above a bar and the conclusion below it.

Definition 4.5 (Edge-inference rules). Let G be a legal OPM graph, and let X and Y be two nodes in G. In the following, we define when X Y can be inferred from G, denoted by G X Y . Specifically, let A, B, and C be artifacts in G, and let P and Q be processes in G. We begin by stating four trivial inference rules, which mean that if an edge already belongs to G, then that edge can be inferred from G. These rules are presented in Figure 5. Next we define four further inference rules, in cases where at least one of the present edges was previously inferred. These rules are presented in Figure 6.

Note that as a direct consequence of the preceding definition, we have the following properties: —G A B if and only if (A, B) belongs to the transitive closure of DerivedEdges; —if G A B and G B P, then G A P; and —if G P A and G A B, then G P B. Edge-inference rules introduced in this section allow us to derive new edges from a graph G, noted as G X Y , with X and Y being two nodes of G. Inferred edges do ACM Transactions on the Web, Vol. 9, No. 2, Article 10, Publication date: May 2015.

A Formal Account of the Open Provenance Model

10:15

Fig. 5. Trivial edge-inference rules.

Fig. 6. Edge-inference rules.

not belong to the sets of edges identified in Definition 3.1, implying that these edges X Y are inferred “outside” G. Thus, the temporal theory of Definition 3.6 does not associate a temporal meaning to these edges directly. In the next section, we observe that inferred edges have a similar temporal semantics as imprecise edges.

4.2. Characterization of Temporal Inference

Let us reconsider the axioms of Definition 3.6 that define the temporal semantics of an OPM graph. We see that each axiom is a rule that relates a pattern in the graph to one or more inequalities. For example, Axiom 2 relates the pattern consisting simply of a ! single edge A → P to the inequalities begin(P) create(A) and create(A) end(P).

Axiom 1 even relates the pattern consisting simply of a process node P to the inequality begin(P) end(P). Axiom 8 has a more complicated pattern in the form of a use– generate–derive triangle.

In a similar way, we now introduce 10 more such rules. Rules 1 through 9A and 9B are shown in Figure 7. (The figure also includes some axioms, but we explain this after the statement of Theorem 4.7.) An important difference with the axioms, however, is that every dashed edge in a pattern now stands not just for an edge that is present in the graph but for an edge that can be inferred by the edge-inference rules.

Example 4.6. In Figure 2, let u1 be the time point where “Take Order” uses the “billing address,” and let u2 be the time point where “Deliver” uses the “invoice info.”

Then Rule 9A derives that u1 u2 . This can be seen by matching node Q in the rule to the node “Deliver” in the graph, A to “invoice info,” B to “billing address,” and P to “Take Order.”

ACM Transactions on the Web, Vol. 9, No. 2, Article 10, Publication date: May 2015.

10:16

N. Kwasnikowska et al.

Fig. 7. Characterization of temporal inference. The numbers (1) through (9A) and (9B) correspond to the rules numbered (1) through (9A) and (9B) stated in Theorem 4.7. Since the theorem also invokes, as Rule (0), the temporal theory of G, we also show the axioms of Th(G) from Definition 3.6 so that this figure gives a complete picture of logical consequence. Note, however, that Axioms 4 through 7 from Definition 3.6 need not be shown because they are already subsumed by Rules (1) through (4). Hence, only Axioms 1, 2, 3, and 8 are shown. For inference of inequalities not involving use-variables, Axioms 1 and 2 and Rules 1 through 4 already suffice; this will be shown in Section 4.3.

ACM Transactions on the Web, Vol. 9, No. 2, Article 10, Publication date: May 2015.

A Formal Account of the Open Provenance Model

10:17

The following theorem, proven in the Appendix, states that these rules are sound and complete in the following sense. The rules are sound in that they represent valid inferences: the inequalities that they infer are indeed logical consequences of the axioms in the sense of Definition 4.1. Moreover, the rules are complete in that any inequality that is a logical consequence of the axioms, and that is not already part of the axioms, can be inferred by one of the 10 rules.

THEOREM 4.7. Let G be a legal OPM graph, and let ϕ be a nontrivial inequality over the temporal variables of G. Then Th(G) |= ϕ if and only if either (0) ϕ already belongs to Th(G) or ϕ matches one of the following inequalities: —Cases not involving use-variables: (1) create(B) create(A) with G A B; (2) begin(P) create(A) with G A P; (3) create(A) end(P) with G P A; (4) begin(Q) end(P) with G P Q; —Cases involving use-variables: r (5) create(B) use(P, r, A) with P → A in G and G A B; r (6) begin(Q) use(P, r, A) with P → A in G and G A Q; (7) use(P, r, C) create(A) with G (B, C, P, r) for some B, and G A B; (8) use(P, r, B) end(Q) with G (A, B, P, r) for some A, and G Q A; s (9) use(P, r, B) use(Q, s, A) with G (C, B, P, r) for some C, with Q → A in G, and either (a) A = C or (b) G A C. Note here that A, B, and C, or P and Q, need not be distinct.

Since Rules 1 through 4 subsume Axioms 4 through 7, Figure 7, which includes the remaining axioms, provides a complete picture of the possible logical consequences of an OPM graph in the sense of Definition 4.1. Definition 4.1 is purely semantic and does not give any concrete algorithm for checking logical consequence. Figure 7 now gives us direct shortcuts from patterns in an OPM graph to its logical consequences.

Indeed, to check that an inequality u v is logical consequence of a graph, it suffices to select the corresponding pattern in Figure 7 and verify that it is satisfied by the graph (extended with the proper inferred edges). Vice versa, if an inequality u v is logical consequence of Th(G), then the corresponding pattern is known to exist in G. We anticipate that developers can leverage Theorem 4.7 to design reasoners for OPM. So far, reasoners have typically relied on Semantic Web technologies, such as OWL and SRWL, to compute transitive closures of OPM properties [Moreau et al. 2010; McGrath and Futrelle 2008]. What this theorem shows is that there are logical consequences involving use-variables that cannot be directly represented by a single edge in OPM graphs; rather, they are represented by graph patterns involving three or more nodes, as shown in Figure 7.

4.3. About Nonuse Inequalities

The OPM reference specification defines edges incident to artifacts in terms of the creation of the artifact, with respect to the creation of another artifact, or the beginning and ending of a process. There is some value in considering a temporal theory that ignores “use” time points, as the theory becomes simpler (although it is unable to tell us anything about usage of artifacts). In this case, it is worth characterizing temporal inference in the context of this simpler theory.

First we state a remarkable corollary, after introducing the following definition.

Definition 4.8. If in an inequality ϕ of the form u v, neither u nor v is a use-variable, then we call ϕ a nonuse inequality.

ACM Transactions on the Web, Vol. 9, No. 2, Article 10, Publication date: May 2015.

10:18

N. Kwasnikowska et al.

As a corollary to Theorem 4.7, we obtain the following completeness result for edge inference, as far as nonuse inequalities are concerned. Note that the edge-inference rules are present as Rules 1 through 4 in Figure 7.

COROLLARY 4.9. Let G be a legal OPM graph, and let ϕ be a nonuse inequality. Then Th(G) |= ϕ if and only if ϕ can be inferred using Axioms 1 and 2 and Rules 1 through 4 in Figure 7.

PROOF. It is clear from Theorem 4.7 that if ϕ can be inferred using Axioms 1 and 2 and Rules 1 through 4, then Th(G) |= ϕ. For the other direction, assume that Th(G) |= ϕ holds. Then we know by Theorem 4.7 that ϕ can be inferred by the axioms and rules presented in Figure 7. By examination of these axioms and rules, however, we notice that Axioms 1 and 2 and Rules 1 through 4 are the only ones that infer nonuse inequalities.

It is interesting to note that when dealing with nonuse inequalities, we do not need the full temporal theory of an OPM graph. We start with a small generalization of Definitions 3.8 and 4.1.

Definition 4.10. Let G be a legal OPM graph, and let u, v ∈ Vars(G). Let be a subset of Th(G). Any temporal interpretation that satisfies all inequalities of is called a temporal model of . Furthermore, the inequality u v is a logical consequence of , denoted by |= u v, if u v is satisfied in every temporal model of .

For a given OPM graph G, we can now select the nonuse inequalities from its temporal theory.

Definition 4.11. For a legal OPM graph G, we define the nonuse temporal theory of G, denoted by Thnon-use (G), as follows: Thnon-use (G) = {ϕ ∈ Th(G) | ϕ is a nonuse inequality} !

∪ {create(A) end(P) | P → A in G} !

∪ {create(B) create(A) | A → B in G}.

The intuition is that Thnon-use (G) does not contain Axioms 3 and 8, and enforces Axioms 4 and 6 for precise and imprecise edges alike.14 We can now observe that use-variables do not influence the nonuse inequalities that are logical consequences of Th(G).

PROPOSITION 4.12. Let G be a legal OPM graph, and let ϕ be a nonuse inequality. Then Th(G) |= ϕ if and only if Thnon-use (G) |= ϕ.

PROOF. Since any temporal model τ of Th(G) is also a temporal model of Thnon-use (G), the if-direction is immediate. For the only-if direction, let τ be a temporal model of Thnon-use (G). We try to extend τ to τ in such a way that τ is a temporal model of Th(G).

For every non–use-variable u, simply put τ (u) = τ (u). Now we have to find suitable values for: r

—use(P, r, A) for each P → A in G so that Axiom 3 is satisfied, and —use(P, r, B) for each G (A, B, P, r) so that Axiom 8 is satisfied. !

that in the full theory Th(G), the nonuse inequality create(A) end(P) for P → A in G is implied by Axiom 3, but since we omit this axiom, we need to recover the inequality in Axiom 6. Likewise, the nonuse

14 Note

!

inequality create(B) create(A) for A → B in G is provided by Lemma 4.2. Since the proof of the lemma utilizes use-variables, the lemma no longer holds, and we need to recover the inequality in Axiom 4.

ACM Transactions on the Web, Vol. 9, No. 2, Article 10, Publication date: May 2015.

A Formal Account of the Open Provenance Model

10:19

Fig. 8. Three legal OPM graphs.

It is easy to verify that Axiom 3 holds if τ (use(P, r, A)) equals the maximum of τ (create(A)) and τ (begin(P)). Likewise, Axiom 8 holds if τ (use(P, r, B)) equals the maximum of τ (create(B)) and τ (begin(P)). Thus, τ satisfies all eight axioms and is a temporal model of Th(G). We know thus that τ satisfies ϕ. Since ϕ is a nonuse inequality, and τ and τ coincide on all variables used in nonuse inequalities, τ also satisfies ϕ.

The preceding proposition together with Corollary 4.9 yields the following.

COROLLARY 4.13. Let G be a legal OPM graph, and let ϕ be a nonuse inequality. Then Thnon-use (G) |= ϕ if and only if ϕ can be inferred using Axioms 1 and 2 and Rules 1 through 4 in Figure 7.

This section provides a remarkable result, as it establishes the completeness of edge inferences (Rules 1 through 4 in Figure 7) for nonuse inequalities. Furthermore, reasoning with use time points does not allow us to derive any new inequality about non–use-variables. We envisage this result to be leveraged by developers of reasoners for OPM, since it offers opportunities to optimize reasoners, by reducing the number of time points to reason over, focusing on non–use-variables in a first phase and dealing efficiently with use-variables afterward.

5. OPERATIONS ON OPM GRAPHS

The reason for capturing provenance is that it can be used to address a variety of use cases [Miles et al. 2007]. To this end, one needs to collect provenance information from potentially different sources across the Web, then combine and process it in multiple ways. It is therefore useful to define operations on OPM graphs, which we anticipate can become part of “provenance toolkits.”

When two OPM graphs are obtained from different sources, a reasoner may want to take their union, if it ascertains that they relate to some common entities. Given two OPM graphs, an intersection operation helps to identify their common elements.

Different sources may use different identifiers for graph nodes; thus, to be able to compute meaningful union and intersection, it may be required that some nodes be renamed before performing these operations. In this section, we formally investigate the effect of such operations on OPM graphs on the temporal theories of these graphs.

Initial observations on graph operations and legality.

(1) A subgraph of a legal OPM graph may not be legal. For example, the graph presented in Figure 8(a) is legal, whereas its subgraph composed of nodes A, B, P, r

r

role r, and edges A → B and A → P is not legal, because the use–generate–derive triangle (A, B, P, r) is not complete.

(2) The union of two legal OPM graphs may not be legal. For instance, the graph presented in Figure 8(a) is legal, and so is the graph in Figure 8(b). The union of ACM Transactions on the Web, Vol. 9, No. 2, Article 10, Publication date: May 2015.

10:20

N. Kwasnikowska et al.

these two graphs, however, is not legal, because in the union, A has two different r

s

precise generated-by edges: A → P and A → Q. (3) The intersection of two legal OPM graphs may not be legal. For instance, consider the graph G shown later in Figure 10(a) and the graph H, which equals G except that identifier P is replaced by a different identifier Q. Then G ∩ H consists only r of the three artifacts A, B, and D and the single edge A → B. Due to this edge (without accompanying use-generate-derive triangle), the intersection is not legal.

Union and intersection of theories. An interesting question for further research would be how to deal with nonlegality of union, or intersection, of legal OPM graphs. Presumably, a kind of “error-correcting” variants of union and intersection may be defined so that the result is always legal, and so that the temporal theory of the result has some desired properties. Although we defer this question to further research, we can already answer some immediate questions about the relationship between legal union and intersection of legal OPM graphs and their temporal theories. Let G and H now be two legal OPM graphs.

PROPOSITION 5.1. If G ∪ H is legal, then Th(G ∪ H) = Th(G) ∪ Th(H).

PROOF. Each inequality in Th(G) or Th(H) corresponds to a single node, a single edge, or some use–generate–derive triangle present in G or H. Thus, all inequalities present in Th(G) ∪ Th(H) also belong to Th(G ∪ H). Moreover, the only additional inequalities in Th(G ∪ H) would correspond to some use–generate-derive triangles that were newly formed by the union of G and H. Since both G and H are legal, this is impossible because legal OPM graphs cannot contain parts of a use–generate–derive triangle.

Therefore, Th(G ∪ H) contains only inequalities that are already present in Th(G), or in Th(H), or in both.

PROPOSITION 5.2. If G ∩ H is legal, then Th(G ∩ H) ⊆ Th(G) ∩ Th(H).

PROOF. Any inequality from Th(G ∩ H) corresponds to a single node, an edge, or a use–generate–derive triangle present in G ∩ H, and thus in both G and H. Therefore, it also belongs to Th(G) ∩ Th(H).

The converse inclusion does not hold. If G consists only of edge P → A, and H ! consists only of edge A → P, then G ∩ H consists of the two nodes A and P. So, Th(G) = {create(A) end(P), begin(P) end(P)}, Th(H) = {begin(P) create(A), create(A) end(P), begin(P) end(P)}, and Th(G ∩ H) = {begin(P) end(P)} .

Clearly, create(A) end(P) ∈ Th(G)∩Th(H) ⊆ Th(G∩ H). Note that create(A) end(P) is not even a logical consequence of Th(G ∩ H).

Remark 5.3. The variant of Proposition 5.1 where we replace the theory by its closure (as defined in Section 6) no longer holds as stated. Indeed, we have Th(G ∪ H) = Th(G) ∪ Th(G) ⊇ Th(G) ∪ Th(H), but the latter containment relation can be strict. To wit, consider G with three artifacts A, B, and C and edge A → B, and H with the same three artifacts and B → C. Then create(C) create(A) belongs to Th(G ∪ H) but not to Th(G) ∪ Th(H).

The variant of Proposition 5.2 with closures does continue to hold as stated. Indeed, we still have Th(G ∩ H) ⊆ Th(G) ∩ Th(H), where the containment can again be strict.

ACM Transactions on the Web, Vol. 9, No. 2, Article 10, Publication date: May 2015.

A Formal Account of the Open Provenance Model

10:21

To wit, consider G with three artifacts A, B, and C and edges A → B → C, and consider H, which equals G except that identifier B is replaced by a different identifier B . Then create(C) create(A) belongs to Th(G) ∩ Th(H) but not to Th(G ∩ H).

5.1. Renaming and Merging

By definition, the nodes and roles of an OPM graph are local to the graph. Prior to performing a union or an intersection of two OPM graphs G and H, we may need to resolve some identity issues between the nodes and roles in the graphs [Missier et al.

2010]. For example, some artifact node A in G may represent the same actual artifact as r some artifact node B in H.15 Likewise, role r in edge P → B in G may refer to the same s actual role as role s in edge Q → C in H, and also P and Q may represent the same actual process. Moreover, it is equally possible that some node or role is accidentally used in both graphs, whereas this node or role does not represent the same actual entity across the two graphs. Resolving such identity issues leads to a renaming operation on one or both of the graphs, whereby nodes and roles representing the same actual entity can be renamed to a common node or role; likewise, nodes and roles not representing the same actual entity, but accidentally used in both graphs, can be renamed to distinct nodes or roles.

Definition 5.4 (Renaming). Let G and H be OPM graphs, which need not be legal.

Let ρArt be a bijection from ArtG to a finite set Art , let ρProc be a bijection from ProcG to a finite set Proc , and let ρRoles be a bijection from RolesG to a finite set Roles , with the sets Art , Proc , and Roles mutually disjoint. Then H is the renaming of G by ρArt , ρProc , and ρRoles , if the following holds: —Art H = Art ; —Proc H = Proc ; —Roles H = Roles ; —GeneratedBy! H = {(ρArt (A), ρRoles (r), ρProc (P)) | (A, r, P) ∈ GeneratedBy!G }; —Used! H = {(ρProc (P), ρRoles (r), ρArt (A)) | (P, r, A) ∈ Used!G }; —DerivedFrom! H = {(ρArt (A), ρRoles (r), ρArt (B)) | (A, r, B) ∈ DerivedFrom!G }; —GeneratedBy H = {(ρArt (A), ρProc (P)) | (A, P) ∈ GeneratedByG }; —Used H = {(ρProc (P), ρArt (A)) | (P, A) ∈ UsedG }; —DerivedFrom H = {(ρArt (A), ρArt (B)) | (A, B) ∈ DerivedFromG }; —InformedBy H = {(ρProc (P), ρProc (Q)) | (P, Q) ∈ InformedByG }.

Note that ArtG and Art need not be disjoint; similarly, neither ProcG and Proc , nor RolesG and Roles , need to be disjoint. Indeed, ρArt , ρProc , and ρRoles may coincide with the identity function on some of their inputs—that is, not all artifacts, processes, and roles need to be renamed.

Example 5.5. We can rename the graph presented in Figure 8(b) by the following bijections: —ρArt (A) = A, ρArt (C) = B, ρArt (D) = F, and ρArt (E) = E; —ρProc (Q) = P; and —ρRoles (s) = r and ρRoles (s ) = r .

15 In

OPM, node identifiers are scoped to a graph. A node may be associated with a URI by means of a property, allowing it to refer to a Web resource.

ACM Transactions on the Web, Vol. 9, No. 2, Article 10, Publication date: May 2015.

10:22

N. Kwasnikowska et al.

Then we can take the union of the renamed graph with the graph shown in Figure 8(a), which yields the legal OPM graph presented in Figure 8(c).

Since the renaming of an OPM graph G is isomorphic to G, and our entire approach (particularly the definition of legality) is “logical” in the sense of Tarski [1986], isomorphic graphs have exactly the same properties. Hence, the following is immediate.

PROPOSITION 5.6. The renaming of a legal OPM graph is legal.

We next define the following generalization of renaming.

Definition 5.7 (Merge-renaming). Let G and H be OPM graphs, which need not be legal. Let ρArt , ρProc , and ρRoles be as in Definition 5.4, except that ρArt , ρProc , and ρRoles need not be bijective: they only need to be surjective (onto) mappings. Then we say that H is the merge-renaming of G by ρArt , ρProc , and ρRoles , exactly if the same equalities of Definition 5.4 hold.

Merge-renaming allows the coalescing of two or more nodes to a single node (or two or more roles to a single role). Coalescing of nodes or roles may be performed when analyzing an OPM graph on a coarser level of detail. But coalescing may also be practical when more information becomes available. For example, in a traffic accident scenario, there may be observations about a “blue car” and other observations about a “Toyota,” only to realize later that the blue car is the Toyota.

In contrast to Proposition 5.6, the merge-renaming of a legal OPM graph need not be legal. For example, in Figure 9(c), if we coalesce C and D into a single artifact E but do not coalesce P and Q, nor their roles, then E has two distinct precise generated-by edges.

As a merge-renaming can coalesce artifacts, such an operation can introduce cycles of derived-from edges to an OPM graph. In the next section, we investigate the consequences of such cycles in OPM graphs.

5.2. Inference of Equalities

Our definitions allow the presence of derived-from cycles in legal OPM graphs. By a derived-from cycle, we mean a directed simple cycle composed of derived-from edges (precise or imprecise). An OPM graph resulting from a typical experimental provenance collection procedure does not contain such cycles, and indeed the current OPM reference specification forbids them. For example, it would be strange to assert that A is derived from B and that B is derived from A. Nevertheless, cycles may arise in a graph when after a merge operation, certain nodes coalesce. Suppose, for example, that we have three artifacts A → B → C without a cycle. If an application does not need the full level of detail provided, it may consider, for example, A and C to be the same at a coarser level of detail. As a consequence, a cycle A → B → C = A is created.

Thus, we do not want to disallow derived-from cycles in OPM graphs from the outset.

It is important, however, to understand the consequences of the presence of such cycles.

We observe that they enforce the equality of certain temporal variables. In the preceding example, we would have create(A) = create(B) = create(C).

First of all, we point out that every OPM graph has a trivial model τtriv consisting of a single time point t0 with τtriv (u) = t0 for every temporal variable u. Indeed, since the temporal theory of an OPM graph consists only of nonstrict inequalities, this interpretation trivially satisfies all nonstrict inequalities. Of course, that does not mean that this trivial model is the only model the OPM graph possesses. On the contrary: intuitively, on a fine enough temporal granularity, we should expect that every OPM graph indeed possesses a model where all temporal variables can be assigned distinct ACM Transactions on the Web, Vol. 9, No. 2, Article 10, Publication date: May 2015.

A Formal Account of the Open Provenance Model

10:23

time points. We observe that this is indeed always possible provided that there are no derived-from cycles.

Formally, we fix some OPM graph G for this section. Let us say that a temporal interpretation (T , ≤, τ ) of G is all-distinct if τ (u) = τ (v) for any two distinct temporal variables u and v of G. When, in addition, ≤ is a total order on T , we say that τ has the strict linear order property.

PROPOSITION 5.8. If G does not contain any derived-from cycles, then G has an alldistinct temporal model that even satisfies the strict-linear-order property.

PROOF. We construct a total order on all temporal variables of G that is a temporal model of G under the identity mapping. Since G does not contain any derived-from cycles, we can linearly order all artifacts so that no artifact has a derived-from edge from an artifact coming later in the order. Note that there may be many possibilities for such an ordering. Any such ordering imposes an ordering on the corresponding createvariables. All begin-variables are placed before all create-variables, in some arbitrary order among them, and similarly all end-variables are placed after all create-variables.

Finally, a use-variable involving artifact A is placed immediately as a successor of create(A). If there are more than one use-variables for the same artifact A, they can all be placed in an arbitrary order right after create(A). By inspecting the axioms, we see that this order satisfies all axioms.

We note that Proposition 5.8 does not state that all temporal models of cycle-free graphs are all-distinct. Rather, it establishes that one such all-distinct model exists.

The next proposition provides a partial converse to Proposition 5.8.

PROPOSITION 5.9. If G does contain a derived-from cycle of length at least two, then G cannot have an all-distinct temporal model.

PROOF. Consider a derived-from cycle, and let A and B be two distinct artifacts on that cycle. Then any temporal model τ should satisfy τ (create(A)) ≤ τ (create(B)) as well as τ (create(B)) ≤ τ (create(A)), so τ (create(A)) equals τ (create(B)). Hence, τ is not all-distinct.

Propositions 5.8 and 5.9 do not specify what happens when there are only derivedfrom cycles of length one (loops). Moreover, for a temporal model τ , they do not specify which distinct variables u and v cannot have distinct τ (u) and τ (v) if the graph contains derived-from cycles. The next proposition fills these gaps by characterizing exactly when two temporal variables must be equal in all temporal models.

Naturally, for two distinct temporal variables u and v of G, we write Th(G) |= u = v to denote that both Th(G) |= u v and Th(G) |= v u. Thus, if Th(G) |= u = v, then there is no model of G that is all-distinct, as any temporal model τ must satisfy τ (u) ≤ τ (v) and τ (v) ≤ τ (u); thus, τ (u) = τ (v). Intuitively, two temporal variables u and v of G such that Th(G) |= u = v can be seen as indistinguishable in the given temporal model, for example, as a result of coalescing some nodes in a graph with a more detailed temporal model.

PROPOSITION 5.10. Th(G) |= u = v if and only if u and v match one or more of the following possibilities: (1) u is create(A), v is create(B), and A and B lie together on a derived-from cycle.

(2) u is create(B), v is use(P, r, B), and in G, the nodes P and B, together with some node C, match the pattern shown in Figure 9(a). Note that B and C need not be distinct.

ACM Transactions on the Web, Vol. 9, No. 2, Article 10, Publication date: May 2015.

10:24

N. Kwasnikowska et al.

Fig. 9. Graph patterns for Proposition 5.10.

(3) u is create(A), v is use(P, r, B), and in G, the nodes P, A, and B, together with some node C, match the pattern shown in Figure 9(b). Note that A, B, and C need not be distinct.

(4) u is use(P, r, B), v is use(Q, s, A), and in G, nodes P, Q, A, and B, together with some nodes C and D, match the pattern shown in Figure 9(c). Note that A, B, C, and D need not be distinct, nor P and Q.16 PROOF. The proof of the if-direction amounts to an inspection of involved patterns to verify that Th(G) |= u = v indeed holds. For example, let us examine pattern in Figure 9(c) in case 4. By Axiom 3, we have Th(G) |= create(B) use(P, r, B) for r s edge P → B and Th(G) |= create(A) use(Q, s, A) for edge Q → A. For the triangle (C, B, P, r) and G B C, we can apply Rule 7 from Figure 7, so we have Th(G) |= use(P, r, B) create(B), and thus Th(G) |= create(B) = use(P, r, B). Likewise, for the triangle (D, A, Q, s) and G A D, we obtain Th(G) |= create(A) = use(Q, s, A). Since A and B lie on a derived-from cycle, we also have Th(G) |= create(A) = create(B), and hence Th(G) |= use(P, r, B) = use(Q, s, A).

The proof of the only-if direction amounts to a lengthy but straightforward inspection of the possible cases where both Th(G) |= u v and Th(G) |= v u, in the characterization of temporal inference provided by Figure 7. For example, in case 4, we clearly see that we can only obtain Th(G) |= use(P, r, B) = use(Q, s, A) by combining the following rules of Figure 7: Rule 9A with again Rule 9A resulting in the pattern from Figure 9(c) with A = C and B = D, Rule 9A with Rule 9B resulting in the pattern from Figure 9(c) with A = C, and Rule 9B with again Rule 9B resulting in the pattern from Figure 9(c).

The patterns of Figure 9(a) through (c) are respectively supergraphs of Axiom 8 and cases 7 and 9B in Figure 7. It is interesting to note that a graph that matches Figure 9(c) s also matches Figure 9(b), since B A can be inferred from B D and D → A in Figure 9(c). Likewise, a graph that matches Figure 9(b) also matches Figure 9(a) since B C can be inferred from B A and A C in Figure 9(b).

Hence, by repeated application of Proposition 5.10 (1) through (4), we derive that all use and create time points for artifacts A, B, C, D in Figure 9(c) are equal. Likewise, we note the equality of all use and create time points for artifacts A, B, C in Figure 9(b) and for B, C in Figure 9(a).

16 Note

!

!

that in Figure 9(c), if C and D coincide, then C → P and D → Q must also coincide for G to be legal.

ACM Transactions on the Web, Vol. 9, No. 2, Article 10, Publication date: May 2015.

A Formal Account of the Open Provenance Model

10:25

The OPM reference specification does not allow derived-from cycles, but it does not define a merge operation either. This section has demonstrated that a merge operation can introduce derived-from cycles into OPM graphs, but they must satisfy some constraints: all time points of artifacts involved in a cycle must coalesce to a single time point. Were a merge operation added to the reference specification, two options are possible. On the one hand, the absence of derived-from cycles can remain a legality constraint, but therefore the merge operation should be such that it coalesces all artifacts (and related process) in a cycle and removes all loops to ensure that legality is preserved. On the other hand, the constraint on derived-from cycles can be lifted, as it is in this article, but the OPM edges decorated with time information and involved in cycles should have equal time information whenever the patterns of Proposition 5.10 are matched.

6. REFINEMENT AND COMPLETION

The OPM reference specification introduces the notion of refinement as a relation between two graphs: this relation expresses that one graph represents a more complete description of execution than another graph. The term refinement is inspired by the concept of specification refinement in formal methods [Woodcock and Davies 1996]. The concept was only intuitively defined as follows: a graph is a refinement of another if dependencies that can be inferred in the original graph are “preserved” in the refinement. The purpose of this section is to formally ground such a notion of refinement in the context of our temporal semantics.17 We fix two legal OPM graphs G and H for use in this section. We also define the following convenient notion.

Definition 6.1. The logical closure of a set of inequalities , denoted by , is the set of logical consequences of —that is, = {ϕ | |= ϕ}.

When context allows, we abbreviate logical closure to closure.

First, we define restriction of an arbitrary set of inequalities to a subset of variables occurring in .

Definition 6.2. Let be a set of inequalities over a set of variables V . Let W be a subset of V . The restriction of to W, denoted by |W , is the set |W = {u v ∈ | u, v ∈ W}.

Given our temporal semantics, the intuition of a refinement is as follows. Graph H is a refinement of G if all temporal constraints that can be inferred from Th(G) can also be inferred from Th(H). Such a definition would be too restrictive, however, as some temporal constraints of Th(G) may be about temporal variables that do not exist in Th(H) at all. Indeed, refinements can replace nodes by others (e.g., when a process is implemented by composing two other processes). Hence, H is a refinement of G if the temporal constraints that can be inferred from Th(G) over the common set of variables between H and G can also be inferred from Th(H). Formally, the definition is expressed as follows.

Definition 6.3 (Refinement). H is a refinement of G if Th(G)|Vars(G)∩Vars(H) ⊆ Th(H).

17 Technically, the OPM reference specification defines refinement between two accounts. However, like graph

operations, it is useful to define refinement over OPM graphs. Since accounts correspond to subgraphs, our definition can naturally be used to compare two accounts for refinement as well. We will formally define accounts in Section 7.

ACM Transactions on the Web, Vol. 9, No. 2, Article 10, Publication date: May 2015.

10:26

N. Kwasnikowska et al.

In this definition, it is not necessary to restrict Th(H) because Th(H) is on the righthand side of a set containment. Indeed, for any three sets A, B, and C, we have that (A ∩ B) ⊆ C if and only if (A ∩ B) ⊆ (C ∩ B).

Note that Theorem 4.7 can be used effectively to decide whether a given graph H is a refinement of a given graph G. Still, the definition of refinement is strictly semantic and does not provide much guidance toward constructing a refinement. An interesting open problem is to find a finite set of graph operations that all result in refinements, and such that every refinement can be obtained by using these operations.

Remark 6.4. It is a consequence of our definition that whenever Vars(G) and Vars(H) are disjoint, then H is a refinement of G and vice versa. Indeed, the operation of first adding to G a separate graph component about an entirely disjoint set of nodes, immediately followed by removing the old contents of G, may be considered as an extreme kind of refinement. At any rate, our definition of refinement remains open to scientific debate.

6.1. Graph Operations and Refinement

In this section, we investigate the relations between the graph operations defined in Section 5 and refinement. We first investigate the subgraph operation, the union, and the intersection. Let G and H be two legal OPM graphs.

PROPOSITION 6.5. If H is a legal subgraph of G, then G is a refinement of H. PROOF. Since H is a subgraph of G, it is clear from Definition 3.6 that Th(H) ⊆ Th(G).

Hence, Th(H)|Vars(H)∩Vars(G) = Th(H) ⊆ Th(G) as desired.

Note that a legal subgraph of G is not necessarily a refinement of G. For instance, let G be a use–generate–derive triangle (A, B, P, r), and let H be a subgraph of G r ! consisting of P → B and A → P. Then H is legal but is not a refinement of G: create(B) create(A) ∈ Th(G)|Vars(G)∩Vars(H) yet create(B) create(A) ∈ Th(H).

The preceding proposition also applies to the union and intersection, as well as their operands.

COROLLARY 6.6. If G ∪ H is legal, then G ∪ H is a refinement of G. Note that G is not necessarily a refinement of a legal G ∪ H. For example, let G ! consist of A → B and node P, and let H consist of A → P and node B. Thus, G ∪ H ! is legal and consists of A → B and A → P. Then G is not a refinement of G ∪ H: G ∪ H P → B, and therefore create(B) end(P) ∈ Th(G ∪ H)|Vars(G∪H)∩Vars(G) yet create(B) end(P) ∈ Th(G).

However, if G and H are node-disjoint, then G is a refinement of G ∪ H. COROLLARY 6.7. G is a refinement of G ∩ H. Note that G ∩ H is not necessarily a refinement of G. For example, let G consist of !

A → Q, A → P, and P → Q, and let H consist of A → Q and P → Q. Then G ∩ H equals H, which is not a refinement of G: create(A) end(P) ∈ Th(G)|Vars(G)∩Vars(H) , yet create(A) end(P) ∈ Th(G ∩ H).

Next we investigate the merge-renaming operation. Let H be a renaming of G by ρArt , ρProc , and ρRoles (conforming to Definition 5.4). Then G is not necessarily a refinement of H, or vice versa. For instance, let G consist of A → B, let ρArt (A) = B and ρArt (B) = A, then H consists of B → A. They are clearly not refinements of each other.

ACM Transactions on the Web, Vol. 9, No. 2, Article 10, Publication date: May 2015.

A Formal Account of the Open Provenance Model

10:27

Still, if one needs to apply a merge-renaming on a graph before performing a union or an intersection, a merge-renaming operation that preserves the temporal constraints of the original would be advisable. This motivates the following restricted version of the merge-renaming operation.

Definition 6.8 (Proper merge-renaming). Let ρArt , ρProc , and ρRoles be as in Definition 5.7, and let ρ be the pointwise union of ρArt , ρProc , and ρRoles . Then we use ρ(G) to denote the merge-renaming of G by ρArt , ρProc , and ρRoles .

We call a merge-renaming ρ(G) proper if for any node (or role) x in G, if ρ(x) = x but ρ(x) is also a node (or role) in G, then ρ(ρ(x)) = ρ(x).

Intuitively, in a proper merge-renaming operation, some nodes/roles are preserved, whereas all others are either renamed into new ones or coalesced into preserved ones.

Such an operation disallows arbitrary renaming and permutation of nodes/roles. Although it seems overly restrictive, it makes sense in the OPM model, because nodes and roles are actually identifiers. Hence, coalescing of nodes/roles, or renaming them into new ones, is a form of identity resolution. For example, witnesses of a car accident may speak of a “blue car” or a “Toyota.” Later on, one realizes that the witnesses talked about the same car, so both “blue car” and “Toyota” should be renamed to the car’s registration number (whereas “blue car” and “Toyota” become its annotations). Likewise, hospitals frequently admit unconscious patients under a temporary ID. Later on, they are either matched to an already known patient or to a new ID if the patient is admitted for the first time.

We conclude this section by showing that a proper and legal merge-renaming of a graph is indeed a refinement of the original graph.

THEOREM 6.9. Let G be a legal OPM graph, and let ρ(G) be a proper and legal merge-renaming of G, for some ρ. Then ρ(G) is a refinement of G. To prove the theorem, we use the following auxiliary lemmas.

LEMMA 6.10. Let G be a legal OPM graph, and let ρ(G) be a legal merge-renaming of G, for some ρ. Then if G X Y , also ρ(G) ρ(X) ρ(Y )—that is, a legal merge-renaming preserves edge-inference.

The preceding lemma is readily verified.

LEMMA 6.11. Let G be a legal OPM graph, and let ρ(G) be a proper merge-renaming of G, for some ρ. If a node (or role) x belongs to both G and to the image of ρ, then ρ(x) = x.

Indeed, if x is in the image of ρ, then there exist a node (role) y in G such that ρ(x) = y.

If x = y, then ρ(x) = x holds immediately. If x = y, then ρ(y) = y, so ρ(ρ(y)) = ρ(y) (by Definition 6.8). Thus, ρ(x) = x holds as desired.

We can now prove the theorem. We need to prove the following: Th(G)|Vars(G)∩Vars(ρ(G)) ⊆ Th(ρ(G)) .

Let Commons = Vars(G) ∩ Vars(ρ(G)). For each inequality ϕ ∈ Th(G)|Commons , we must show that ϕ belongs to Th(ρ(G)). We know from Theorem 4.7, illustrated in Figure 7, that each such inequality is associated with a pattern in G. Therefore, we need to find a similar pattern in ρ(G) that produces exactly the same inequality.

Let ϕ ∈ Th(G)|Commons . We follow the axioms and rules presented in Figure 7—the axioms first—to cover all possible forms that ϕ may assume: (a) ϕ is begin(P) end(P), for some P in G. Since begin(P), end(P) ∈ Commons, P is also present in ρ(G). By Axiom 1, begin(P) end(P) ∈ Th(ρ(G)).

ACM Transactions on the Web, Vol. 9, No. 2, Article 10, Publication date: May 2015.

10:28

N. Kwasnikowska et al. !

(b) ϕ is begin(P) create(A) or create(A) end(P), for some A → P in G. Since create(A), begin(P), end(P) ∈ Commons, we also have A and P in ρ(G). From ! !

A → P in G, by Definition 6.8, we have ρ(A) → ρ(P) in ρ(G). We can apply !

Lemma 6.11 to A and P, obtaining ρ(A) = A and ρ(P) = P. Hence, A → P is also in ρ(G) and, by Axiom 2, both begin(P) create(A) and create(A) end(P) belong ! ! to Th(ρ(G)). Note that A → P in G and A → P in ρ(G) need not have the same role. (c) ϕ is one of the following: begin(P) use(P, r, A), use(P, r, A) end(P), or r create(A) use(P, r, A), for some P → A in G. The variable use(P, r, A) belongs to r Commons; that is only possible if edge P → A is also present in ρ(G). By Axiom 3, begin(P) use(P, r, A), use(P, r, A) end(P), and create(A) use(P, r, A) belong to Th(ρ(G)). r (d) ϕ is use(P, r, B) create(A), for some G (A, B, P, r). For P → B in G, we apply r ! ! case c, so P → B is also in ρ(G). For A → P in G, by case b, A → P belongs to ρ(G).

We can apply Lemma 6.11 to A, B, and r, obtaining ρ(A) = A, ρ(B) = B, and ρ(r) = r. r

(e)

(f)

(g)

(h)

(i)

(j)

(k)

ρ(r)

r

For A → B in G, we apply Definition 6.8, so ρ(A) → ρ(B) in ρ(G), and thus A → B in ρ(G). Clearly, ρ(G) (A, B, P, r), and hence use(P, r, B) create(A) ∈ Th(ρ(G)) (Axiom 8). ϕ is create(B) create(A), for G A B. Since create(A), create(B) ∈ Commons, A and B also belong to ρ(G). From G A B, by Lemma 6.10, we have ρ(G) ρ(A) ρ(B). We can apply Lemma 6.11 to A and B, obtaining ρ(A) = A and ρ(B) = B. Hence, ρ(G) A B as desired and, by Rule 1, create(B) create(A) ∈ Th(ρ(G)). ϕ is begin(P) create(A), for G A P. Since create(A), begin(P), end(P) ∈ Commons, A and P belong to ρ(G). From G A P, by Lemma 6.10, ρ(G) ρ(A) ρ(P). We can apply Lemma 6.11 to A and P, obtaining ρ(A) = A and ρ(P) = P. Thus, ρ(G) A P and, by Rule 2, begin(P) create(A)∈ Th(ρ(G)). ϕ is create(A) end(P), for G P A. Since create(A), begin(P), end(P) ∈ Commons, A and P belong to ρ(G). From G P A, by Lemma 6.10, we have ρ(G) ρ(P) ρ(A). We can apply Lemma 6.11 to A and P, obtaining ρ(A) = A and ρ(P) = P. Therefore, ρ(G) P A and, by Rule 3, create(A) end(P) ∈ Th(ρ(G)). ϕ is begin(Q) end(P), for G P Q. Since begin(P), end(P), begin(Q), end(Q) ∈ Commons, P and Q belong to ρ(G). From G P Q, by Lemma 6.10, ρ(G) ρ(P) ρ(Q). We can apply Lemma 6.11 to P and Q, obtaining ρ(P) = P and ρ(Q) = Q. Hence, ρ(G) P Q and, by Rule 4, begin(Q) end(P) ∈ Th(ρ(G)). r ϕ is create(B) use(P, r, A), for P → A in G and G A B. By applying cases c r r and e to P → A in G and G A B, respectively, we have P → A in ρ(G) and ρ(G) A B. By Rule 5, create(B) use(P, r, A) ∈ Th(ρ(G)). r ϕ is begin(Q) use(P, r, A), for P → A in G and G A Q. By applying cases c r r and f to P → A in G and G A Q, respectively, we have P → A in ρ(G) and ρ(G) A Q. By Rule 6, begin(Q) use(P, r, A) ∈ Th(ρ(G)). ϕ is use(P, r, C) create(A), for G (B, C, P, r) and G A B. By applying cases d and e to G (B, C, P, r) and G A B, respectively, we have ρ(G) (B, C, P, r) and ρ(G) A B. By Rule 7, use(P, r, C) create(A) ∈ Th(ρ(G)).

ACM Transactions on the Web, Vol. 9, No. 2, Article 10, Publication date: May 2015.

A Formal Account of the Open Provenance Model

10:29

Fig. 10. Completion operations: process introduction (a) and artifact introduction (b).

(l) ϕ is use(P, r, B) end(Q), for G (A, B, P, r) and G Q A. By applying cases d and g to G (A, B, P, r) and G Q A, respectively, we have ρ(G) (A, B, P, r) and ρ(G) Q A. By Rule 8, use(P, r, B) end(Q) ∈ Th(ρ(G)). s (m) ϕ is use(P, r, B) use(Q, s, A), for G (C, B, P, r) and Q → A in G, and either s A = C or G A C. By applying cases d and c to G (C, B, P, r) and Q → A, s respectively, we obtain ρ(G) (C, B, P, r) and Q → A in ρ(G). If A = C, then A clearly belongs to G and to the image of ρ, and therefore by Lemma 6.11, ρ(A) = A. If G A C, then, by case e, ρ(G) A C. We can thus apply either Rule 9A or Rule 9B, so use(P, r, B) use(Q, s, A) ∈ Th(ρ(G)).

6.2. Completion Operations

The edge-inference rules introduced in Definition 4.5 allow new edges to be inferred in an OPM graph, with the nodes of the graph remaining unchanged. The OPM reference specification also defines completion operations, which add new nodes and new edges to a graph. The addition of new nodes is an object-creating operation that, in logic programming, is implemented using Skolem functions [Hull and Yoshikawa 1990].

The rationale for such completion operations was to provide syntactic transformations over graphs, which offer an explanation for some OPM edges. First, we present the operations graphically and intuitively before formalizing them. According to Figure 10(a), process introduction states that if an artifact B was derived from an artifact A, then there exist a process R and role r such that B was generated by R with role r and R used A. The operation does not specify which process was involved, nor the role of B with regard to this process, but it states that such a process R and role r existed. Likewise, artifact introduction, presented in Figure 10(b), states that if there is a process Q that was informed by a process P, then there exist an artifact C and a role s such that Q used C precisely with role s and C was generated by P. Again, the completion does not specify which artifact and role were involved.18 We can see that process introduction generalizes the use–generate–derive triangle of Figure 3 to imprecise derived-from and used-edges. We refer to this triangle as an imprecise use–generate–derive triangle. Likewise, artifact introduction recognizes the existence of a complementary imprecise use–generate–inform triangle. (We note that there is no precise use–generate–inform triangle, as informed-by edges are always imprecise.)

Completion operations should be considered in conjunction with legality constraints.

For instance, Figure 11(a) depicts an artifact A2 derived from two artifacts A0 and A1 .

The process introduction operation can be applied twice here, but the legality constraint 18 The reference specification also defines a third completion operation called artifact elimination, but that operation is nothing other than the inference of informed-by edges.

ACM Transactions on the Web, Vol. 9, No. 2, Article 10, Publication date: May 2015.

10:30

N. Kwasnikowska et al.

Fig. 11. Process introduction producing a legal graph.

Fig. 12. When a completion becomes an edge inference.

Fig. 13. Uncertainty: is P0 = P1 or P0 = P1 ?

Fig. 14. Uncertainty: is A0 = A1 or A0 = A1 ?

requires an artifact to be generated by a single process. Hence, Figure 11(b) displays the only possible completion, where introduced process P used both A0 and A1 and generated A2 .

Application of process insertion to the graph of Figure 12(a) entails that there is a process that used A0 and that generated A2 precisely, but the legality constraint implies that this process is P. Hence, we can derive that P used A0 , which is the inference of a used-edge as in Definition 4.5.

Completion operations can introduce new nodes in a graph but can result in some uncertainty as illustrated by Figures 13 and 14. In Figure 13, it is unknown whether the two processes P0 and P1 introduced by the process introduction operation are identical.

Likewise, in Figure 14, it is not known whether the two artifacts A0 and A1 introduced by artifact introduction are the same. This uncertainty is formalized in the following to the effect that completion is a nondeterministic operation: a given graph may have several possible completions.

To define completion formally, we first formalize the notions of triangle relevant to completion operations.

Definition 6.12 (Complete triangle for B → A). Let G be an OPM graph with two artifacts A and B and an imprecise edge B → A. Graph G contains a complete triangle r for B → A if there exist a process R and role r in G, with edges B → R and R → A. We then say that B, A, R, r constitute an imprecise use–generate–derive triangle.

Definition 6.13 (Complete triangle for Q → P). Let G be an OPM graph with two processes Q and P and an informed-by edge Q → P. Graph G contains a complete s triangle for Q → P if there exist an artifact C and role s in G, with edges Q → C and C → P. We then say that Q, P, C, s constitute an imprecise use–generate–inform triangle.

There can be at most one complete triangle for a given imprecise edge B → A in a legal OPM graph G, as B can only be generated by one process R. On the other hand, there may be several complete triangles for a given imprecise edge Q → P: for instance, ACM Transactions on the Web, Vol. 9, No. 2, Article 10, Publication date: May 2015.

A Formal Account of the Open Provenance Model

10:31

two artifacts C1 , C2 could be generated by P and used by Q, with respective roles s1 and s2 .

We then define a completion operation as possibly introducing a node, a role, and edges, as appropriate, to form complete triangles.

Definition 6.14 (Completion operation). Let G be an OPM graph. A graph H results from a completion operation on G, if H was obtained as follows: —H is the result of process introduction for B → A in G, with A, B ∈ ArtG , if there exist a process R and a role r such that —Proc H = ProcG ∪ {R}, —Roles H = RolesG ∪ {r}, —GeneratedBy! H = GeneratedBy!G ∪ {(B, r, R)}, —Used H = UsedG ∪ {(R, A)}, and —all other sets remain the same; —H is a result of artifact introduction for Q → P in G, with P, Q ∈ ProcG , if there exist an artifact C and a role s such that: —Art H = ArtG ∪ {C}, —Roles H = RolesG ∪ {s}, —GeneratedBy H = GeneratedByG ∪ {(C, P)}, —Used! H = Used!G ∪ {(Q, s, C)}, and —all other sets remain the same.

We note that a completion operation can introduce new nodes R and C or reuse existing ones in G. Likewise, they can create new edges or reuse existing ones. In some cases, a completion operation is exactly an edge inference (cf. inference of used-edges in Definition 4.5).

Not all completion operations lead to legal graphs. Hence, a completion operation applied to legal graph G is said to be valid if it results in a legal graph H. We then call H a valid completion of G. Since G is always a subgraph of H, the result of a completion is always a refinement of G (Proposition 6.5). The converse does not hold, however. Indeed, let us consider a graph G with imprecise edges C → A and C → B, and an isolated process P. If graph H is the result of completing C → A via P, we can infer H P B. Hence, the inequality create(B) end(P) holds in H but not in G. Alternatively, let us consider a graph G with imprecise edges Q → P and B → A. If graph H is the completion of Q → P via B, then H Q A, which cannot be inferred in G. Thus, in summary, graphs can be completed nondeterministically, but completions are a refinement of the original graph.

7. MULTIACCOUNT OPM GRAPH

In the OPM reference specification [Moreau et al. 2011], OPM graphs can contain multiple accounts. Accounts are used to identify parts of a large, integrated, OPM graph, in which each account is a coherent OPM graph in itself. An account should be perceived as one perspective on what happened during a past execution.

Example 7.1. Recall the graph of Figure 1 describing the ordering of an e-book and a toy from an e-shop. Assume that the e-book is for Alice and the toy is for Alice’s young son Bob. Figure 15 shows an extension of the graph with a second account that accounts for Bob’s simple perspective of his mother getting him a new toy. Bob’s account is drawn in another color. Note that the nodes “order” and “toy” belong to both accounts, as well as the edge between them.

ACM Transactions on the Web, Vol. 9, No. 2, Article 10, Publication date: May 2015.

10:32

N. Kwasnikowska et al.

Fig. 15. OPM graph with two accounts.

We define a multiaccount OPM graph as follows.

Definition 7.2 (Multiaccount OPM graph). A multiaccount OPM graph is a structure (Art, Proc, Roles, GeneratedBy!, Used!, DerivedFrom!, GeneratedBy, Used, DerivedFrom, InformedBy, accountOf), where —Art and Proc are two disjoint finite sets of elements called artifacts and processes, respectively; —Roles is a finite set of elements called roles; —GeneratedBy! ⊆ Art × Roles × Proc; —Used! ⊆ Proc × Roles × Art; —DerivedFrom! ⊆ Art × Roles × Art; —GeneratedBy ⊆ Art × Proc; —Used ⊆ Proc × Art; —DerivedFrom ⊆ Art × Art; —InformedBy ⊆ Proc × Proc; and —accountOf is a function from Nodes ∪ Edges to P(Account), the set of all subsets of Account, where —Account is a finite set of elements called accounts, —Nodes = Art ∪ Proc, and —Edges = GeneratedBy! ∪ Used! ∪ DerivedFrom! ∪ GeneratedBy ∪ Used ∪ DerivedFrom ∪ InformedBy. The sets Art, Proc, Roles, and Account are mutually disjoint.

In a multiaccount OPM graph G, every node and edge of G can be associated with zero, one, or more accounts, which is captured by the function accountOf, provided as the last constituent of graph G. ACM Transactions on the Web, Vol. 9, No. 2, Article 10, Publication date: May 2015.

A Formal Account of the Open Provenance Model

10:33

For a given OPM graph G, for any A ∈ Art, we call accountOf(A) the account membership of Ain G. Likewise, for any P ∈ Proc, we call accountOf(P) the account membership of P in G. For a precise edge e in G, of the form (x, r, y), or for an imprecise edge e in G, of the form (x, y), we say that x and y are incident to e and denote this by the predicates isIncident(x, e) and isIncident(y, e).

To ensure that the source and destination of an edge belong to the same account as the edge, a node “inherits” and cumulates the account memberships of the edges to which it is incident. Formally, this is expressed as follows.

Definition 7.3 (Effective account). For a given OPM graph G, we define the effectiveaccount function effectiveAccountOf G : Nodes ∪ Edges → P(Account) as follows: —If x ∈ Nodes, then effectiveAccountOf G (x) = accountOf(x) ∪

{accountOf(e) | e ∈ Edges and isIncident(x, e)}.

—If x ∈ Edges, then effectiveAccountOf G (x) = accountOf(x).

An account view is the single-account OPM graph extracted from a multiaccount OPM graph by restricting attention to the nodes and edges associated with a given account. Formally, this operation is defined as follows.

Definition 7.4 (Account view). For a given multiaccount OPM graph G and an account α, we define the account view of G according to α, denoted by view(G, α), as follows: —Artview(G,α) = {A ∈ Art | α ∈ effectiveAccountOf G (A)}; —Procview(G,α) = {P ∈ Proc | α ∈ effectiveAccountOf G (P)}; —Rolesview(G,α) = {r ∈ Roles | (x, r, y) is an edge in view(G, α)}; —GeneratedBy!view(G,α) = {(A, r, P) | α ∈ effectiveAccountOf G (A, r, P)}; —Used!view(G,α) = {(P, r, A) | α ∈ effectiveAccountOf G (P, r, A)}; —DerivedFrom!view(G,α) = {(A, r, B) | α ∈ effectiveAccountOf G (A, r, B)}; —GeneratedByview(G,α) = {(A, P) | α ∈ effectiveAccountOf G (A, P)}; —Usedview(G,α) = {(P, A) | α ∈ effectiveAccountOf G (P, A)}; —DerivedFromview(G,α) = {(A, B) | α ∈ effectiveAccountOf G (A, B)}; and —InformedByview(G,α) = {(P, Q) | α ∈ effectiveAccountOf G (P, Q)}.

Definition 7.5. A multiaccount OPM graph is called legal if all of its account views are legal.

Note that in a legal multiaccount OPM graph, we can perform temporal inferences on each account view, although separately. It is difficult to define temporal inference on the whole graph, as each account potentially provides a different perspective.

However, one can perform various graph operations to combine different accounts into a single one and then perform temporal inference on the latter. One can also establish whether one account is a refinement of another one.

ACM Transactions on the Web, Vol. 9, No. 2, Article 10, Publication date: May 2015.

10:34

N. Kwasnikowska et al.

8. RELATED WORK

With well over 400 publications [Moreau 2010b] on the topic of provenance, this section focuses on OPM-specific related work. For a broader perspective, we refer the reader to comprehensive surveys for provenance and e-science [Simmhan et al. 2005], provenance and databases [Buneman et al. 2008; Cheney et al. 2009], and provenance and the Web [Moreau 2010b].

Cheney [2010] investigates the use of structural causal models as a semantics for provenance graphs and relates some OPM concepts to notions of actual cause and explanation proposed by Halpern and Pearl [2005]. Cheney considers only a small fragment of OPM, having only used and generated-by edges, and interpreting processes as functions. As a consequence, he considers some inferences, such as those considered in Remark 2.4, which are not part of the OPM reference specification and which are unsound for the temporal semantics considered in this article. On the other hand, Cheney’s semantics attempts the more ambitious goal of providing a global approximation (using the predictive nature of causal models) for the program being executed (without having its explicit code) so that its behavior can be repeated for any arbitrary input; our semantics is silent about the predictive nature of OPM graphs.

Missier and Goble [2011] address the question of whether, for any OPM graph, there exists a plausible workflow in the Taverna workflow language, which could have generated the graph. To this end, they identify the extra information that should be captured as part of an OPM graph so that the mapping from OPM to a workflow representation can be derived. Thus, this work derives an executable semantics for OPM, obtained by composing their translation and the Taverna semantics. However, it does not tackle OPM in full, ignoring accounts, time, and refinement; their translation should be revisited to leverage the distinction between precise and imprecise edges introduced in this work. Similarly, Kwasnikowska and Van den Bussche [2008] map the NRC dataflow model, a formally specified data model for workflows, to OPM. Moreau [2010a] proposes the reproducibility semantics for OPM, which is a denotational semantics characterizing how an OPM graph can be used to reproduce a past computation; a “re-execution” of such a graph results in a new OPM graph and mapping of nodes from the original graph to the new graph. By doing so, he identifies a class of reproducible OPM graphs. The reproducibility semantics assumes a mapping of each process to a function (taking some inputs artifacts and generating some output artifact), and, like Cheney’s causal semantics of OPM, sees an OPM graph as a function operating on inputs and producing outputs. Moreau defines a notion of refinement corresponding to the nested execution of procedures. Future work could try to integrate Moreau’s reproducibility semantics and the temporal semantics presented in this article.

Several approaches are specializing OPM to specific application domains or facets of computing. Groth and Moreau [2011] introduce the D-Profile as a specialization of OPM for distributed systems. Their profile comprises artifact and process types and graph patterns to describe communications in distributed systems. Similarly, Freitas et al.

[2011] introduce types of processes, artifacts, and agents to describe data publication over the Web. Several teams have adopted OPM and implemented inferences, as prescribed by the reference specification. To this end, many teams have exploited Semantic Web technologies, such as OWL and SWRL, to implement OPM reasoning: for example, Tupelo [McGrath and Futrelle 2008], OPMO [Moreau et al. 2010], Provenance Challenge 3 Tetherless [Ding et al. 2011], or reproducibility service [Moreau 2010a]; alternatively, some teams used recursive queries in relational databases: for example, OPMProv [Lim et al. 2011]. It is an open question as to whether the complete specification of PROVCONSTRAINTS can be implemented in any of the OWL2 profiles.

ACM Transactions on the Web, Vol. 9, No. 2, Article 10, Publication date: May 2015.

A Formal Account of the Open Provenance Model

10:35

W3C standardization activities. As part of the W3C Provenance Incubator Activity [2010], mappings of multiple provenance ontologies to OPM were defined [Sahoo et al.

2010]. These mappings showed that concepts such as processes and artifacts mapped quite naturally between models. The mappings did not take into account the temporal meaning of the various data models; revisiting these mappings in the light of this temporal semantics would provide a better correspondence between ontologies. Likewise, Miles [2011] explains how Dublin Core provenance-related concepts can be translated into OPM graphs. Given that Dublin Core also introduces time, a finer-grained mapping could be derived based on the temporal semantics introduced in this article.

The aim of the W3C Provenance Working Group [W3C PROV 2011] was to support the widespread publication and use of provenance information of Web documents, data, and resources. The Working Group has developed PROV, which is a standard language for exchanging provenance information among applications [Moreau et al. 2013]. As mentioned in the Introduction, the PROV data model has been influenced by the OPM data model. The PROV data model has many more features, but we restrict attention in the following discussion on how it can represent the features considered in the present work.

In PROV, artifacts and processes are called entities and activities, respectively.

Derived-from, generated-by, used, and informed-by edges are stated in PROV in the form of facts with predicates “wasDerivedFrom,” “wasGeneratedBy,” “used,” and “wasInformedBy,” respectively. Each fact has an identifier, which can be unnamed, in which case an existential variable is used as the identifier. The identifiers occurring in “wasGeneratedBy” and “used” facts serve as temporal variables for the corresponding time points of creation of an artifact (entity) and usage of an artifact by a process (activity), respectively. The time points of beginning and ending of a process can be indicated in PROV by the identifiers occurring in “wasStartedBy” and “wasEndedBy” facts. Use– generate–derive triangles can be stated in PROV by referring, in the “wasDerivedFrom” fact, to the identifiers occurring in the “used” and “wasGeneratedBy” facts. Such “wasDerivedFrom” facts can then be considered as representing precise derived-from edges.

PROV facts may carry temporal annotations; in this way, a specific (possibly partial) temporal interpretation may be provided. The temporal annotations are subject to constraints in the form of inequalities [Cheney et al. 2013]. This allows us to compare the axioms from Definition 3.6 with the PROV constraints: (1) (2) (3) (4) (5)

Axiom 1 is present in PROV as Constraint 30.

Axiom 2 is present in PROV as Constraint 34.

Axiom 3 is present in PROV as Constraints 33 and 37 combined.

Axiom 4 is present in PROV as Constraint 42.19 Axiom 5 is not present, as imprecise generated-by edges cannot be directly asserted as such in PROV. (6) Axiom 6 is not present, as imprecise used edges cannot be directly asserted as such in PROV.20 19 With

the caveat that PROV specifies strict inequalities. however, one may simulate an imprecise used edge p → e (with p a process/activity and e an artifact/entity) with a used-fact with an unnamed identifier. The usage event will then be represented by an existential variable, which we denote by _u here: 20 Here,

used(_u; p, e, -) wasEndedBy(end; p, -, -, -) wasGeneratedBy(gen; e, -, -).

The identifiers end and gen serve to represent the temporal variables create(e) and end( p), respectively.

Now, PROV Constraint 37 yields that gen must precede _u, and Constraint 33(2) yields that _u must precede

ACM Transactions on the Web, Vol. 9, No. 2, Article 10, Publication date: May 2015.

10:36

N. Kwasnikowska et al.

(7) Axiom 7 is present in PROV as Constraint 35.

(8) Axiom 8, finally, is present in PROV as Constraint 41.

The Working Group [Moreau et al. 2013] is further defining two relations— alternateOf and specializationOf—which in the context of OPM would link two artifacts that denote a same thing in the world. If such relations are asserted, then the artifacts that are linked by such relations are candidates for the merge operation defined in this article.

9. CONCLUSION

In this article, we have shown how OPM can be given a formal semantics. Let us summarize again the main steps of our approach. We have first syntactically enriched OPM by making an explicit distinction between precise and imprecise edges. We have then defined a set of temporal variables associated to an OPM graph. These variables represent the time points of creation of artifacts, of beginning and ending of processes, and of usage of artifacts by processes. An OPM graph is then viewed as a logical theory— that is, a set of formulas. These formulas are simple inequalities and are produced from the edges in the graph in the way specified in Definition 3.6. Now, any way to assigning concrete time point values to the different events in a graph is called an interpretation of the graph (Definition 3.5). These values may in principle come from any partially ordered set, although typically this partially ordered set will be the integers or the real or rational numbers. Only when the interpretation satisfies the inequalities inherent to the graph (i.e., the inequalities from its theory) is the interpretation considered to be satisfactory; we then call it a temporal model of the graph (Definition 3.8).

A very natural question now is, given an OPM graph, to understand which inequalities are guaranteed to be satisfied in all of its temporal models. Our main Theorem 4.7 shows that these “implied” inequalities allow a very clear and concise characterization: to verify whether an inequality is implied, it suffices to match its associated graphical pattern against the graph. The comprehensive list of graphical patterns is given in Figure 7. Crucially, these graphical patterns involve the notion of “inferred edges.” These are edges that can be traced out in the graph by following paths on derived-from edges, as pictorially illustrated in Figure 4 and formally defined in Definition 4.5. Edge inference was already considered in the original OPM reference specification, but purely as a syntactical game, without any semantical justification. Moreover, we had to enrich edge inference to account better for precise edges. In fairness, however, it turns out that when use–time points are ignored, the original OPM edge inference rules have been complete all along (Section 4.3). This result comes full circle and is very satisfying, as it confirms formally that the original intuition behind OPM (which was developed as a community effort) was largely correct.

The computational complexity of deciding whether a given inequality belongs to the temporal theory of a given OPM graph is polynomial time. The complexity is actually dominated by the transitive closure computation on derived-from edges that is needed to perform the edge inferences given in Figure 4. After that, inference amounts to retrieving the relevant graph patterns listed in Figure 7. Each graph pattern can be implemented by a fixed conjunctive database query applied to the graph augmented with inferred edges. Hence, techniques for recursive and join query processing, well established in database systems, can be applied for inferencing in large provenance graphs. end. Since _u is an existential variable, we can express this as ∃u : gen < u < end, which amounts to create(e) < end( p), which is what Axiom 6 would produce.

ACM Transactions on the Web, Vol. 9, No. 2, Article 10, Publication date: May 2015.

A Formal Account of the Open Provenance Model

10:37

Our semantics is explicitly temporal in nature; the time aspect of OPM was kept in the core specification21 because it is regarded as fundamental to the model. In this article, we have shown that time is fundamental to the core of OPM. OPM is “merely” an exchange format for representing provenance information; the next question then, of course, is how to extract provenance information out of running systems or out of databases. Much research exists on this question, and we refer the reader to the surveys of Simmhan et al. [2005], Buneman et al. [2008], and Cheney et al. [2009] for more information.

Further research. Some open problems within the scope of the present article that we have left open are the following. First, the OPM reference specification also includes the feature of Agents—a feature that we have left out in this work. Given that some proposals are beginning to emerge for agents [Myers 2010; Moreau et al. 2013], a topic for further research is to provide a temporal interpretation that can accommodate the notion of agent and its relation with processes.

Second, adopting Lamport’s definition of parallel events [Lamport 1978], two variables u, v in Vars(G) could be defined as parallel events if neither u v nor v u are logical consequences of G’s theory. In future work, one could take a parallel perspective on OPM and investigate patterns of parallelism in OPM graphs.

Finally, in Section 6, we proposed a definition of refinement in OPM. As already mentioned, it would be useful to explore the existence of a finite set of graph transformations that could be used to derive all possible refinements. In addition, the notion of refinement could take further constraints into consideration, such as process nesting [Moreau 2010a].

APPENDIX A. PROOF OF THEOREM 4.7

In this section, we present the proof of Theorem 4.7. First, we tackle the soundness property; then, we address the completeness property.

A.1. Proof of Soundness

Let G be a legal OPM graph, and let ϕ be a nontrivial inequality over the temporal variables of G that satisfies the conditions from Theorem 4.7. We have to show that Th(G) |= ϕ. Thereto, let τ be a temporal model of G—that is, τ |= Th(G). We have to show that τ satisfies ϕ. We inspect the 10 possibilities for ϕ: (0) if ϕ ∈ Th(G), then τ satisfies ϕ since τ |= Th(G).

(1) ϕ is create(B) create(A) with G A B. As a consequence of Definition 4.5, G A B holds if (A, B) belongs to the transitive closure of DerivedEdges. Therefore, there is a path A1 , A2 , . . . , An of derived-from edges from A to B, for some n ≥ 2 with A1 = A and An = B, and with (Ai , Ai+1 ) ∈ DerivedEdges, for i ∈ {1, . . . , n − 1}. Since every (Ai , Ai+1 ) is an edge in G, we know that create(Ai+1 ) create(Ai ) belongs to Th(G) (Axiom 4 and Lemma 4.2) and is thus satisfied by τ —that is, τ (create(Ai+1 )) ≤ τ (create(Ai )).

Hence, we also have τ (create(An)) ≤ τ (create(A1 )), because ≤ is a partial order for τ . Thus, τ satisfies create(B) create(A).

(2) ϕ is begin(P) create(A) with G A P.

By Definition 4.5, G A P if either 21 http://twiki.ipaw.info/bin/view/OPM/ChangeProposalMoveTimeToProfile.

ACM Transactions on the Web, Vol. 9, No. 2, Article 10, Publication date: May 2015.

10:38

N. Kwasnikowska et al. !

(3)

(4)

(5)

(6)

(7)

(a) there is already an edge A → P or A → P in G, or (b) there is an artifact B such that G A B and there is an edge B → P or !

B → P in G. !

(2a) For an edge A → P (A → P) in G, we know by Axiom 5 (Axiom 2) that ϕ ∈ Th(G), and thus τ satisfies ϕ.

(2b) We already know from case 1 that τ satisfies create(B) create(A) for G A B—that is, we have τ (create(B)) ≤ τ (create(A)). For an edge B → P !

(B → P) in G, we know by Axiom 5 (Axiom 2) that begin(P) create(B) belongs to Th(G). Therefore, τ satisfies begin(P) create(B)—that is, τ (begin(P)) ≤ τ (create(B)). Hence, τ (begin(P)) ≤ τ (create(A)), as ≤ is a partial order for τ .

We conclude that τ satisfies begin(P) create(A). ϕ is create(A) end(P) with G P A.

By Definition 4.5, G P A if either ! (a) there is already an edge P → A or P → A in G, or (b) there is an artifact B such that G B A and there is an edge P → B or ! !

P → B or B → P in G. !

(3a) For an edge P → A (P → A) in G, we know by Axiom 6 (Axiom 3) that ϕ ∈ Th(G), and thus τ satisfies ϕ.

(3b) We already know from case 1 that τ satisfies create(A) create(B) for G !

B A. For an edge P → B (P → B) in G, we know by Axiom 6 (Axiom 3) ! that create(B) end(P) belongs to Th(G). For an edge B → P in G, we know

by Axiom 2 that create(B) end(P) belongs to Th(G). Therefore, in each case, τ satisfies both create(A) create(B) and create(B) end(P). Hence, τ also satisfies create(A) end(P). ϕ is begin(Q) end(P) with G P Q.

By Definition 4.5, G P Q if either (a) there is already an edge P → Q in G; or (b) there is an artifact A such that G A Q, and either G P A or there is ! an edge A → P in G. (4a) For an edge P → Q in G, we know by Axiom 7 that ϕ ∈ Th(G), and thus τ satisfies ϕ.

(4b) We already know from case 2 that τ satisfies begin(Q) create(A) for G A Q. We also know from case (3) that τ satisfies create(A) end(P) for G !

P A. For an edge A → P in G, we know by Axiom 2 that create(A) end(P) belongs to Th(G). Therefore, in each case, τ satisfies both begin(Q) create(A) and create(A) end(P). Thus, τ also satisfies begin(Q) end(P). r ϕ is create(B) use(P, r, A) with P → A in G and G A B. We already know from case 1 that τ satisfies create(B) create(A) for G A B. r For edge P → A in G, we know by Axiom 3 that create(A) use(P, r, A) belongs to Th(G) and is thus satisfied by τ . Therefore, τ also satisfies create(B) use(P, r, A). r ϕ is begin(Q) use(P, r, A) with P → A in G and G A Q .

We already know from case 2 that τ satisfies begin(Q) create(A) for G A Q. r For edge P → A in G, we know by Axiom 3 that create(A) use(P, r, A) belongs to Th(G) and is thus satisfied by τ . Thus, τ also satisfies begin(Q) use(P, r, A). ϕ is use(P, r, C) create(A) with G (B, C, P, r) and G A B. We already know from case 1 that τ satisfies create(B) create(A) for G A B. From G (B, C, P, r), we know by Axiom 8 that use(P, r, C) create(B) belongs to Th(G) and is thus satisfied by τ . Therefore, τ also satisfies use(P, r, C) create(A).

ACM Transactions on the Web, Vol. 9, No. 2, Article 10, Publication date: May 2015.

A Formal Account of the Open Provenance Model

10:39

(8) ϕ is use(P, r, B) end(Q) with G (A, B, P, r) and G Q A. We already know from case 3 that τ satisfies create(A) end(Q) for G Q A. From G (A, B, P, r), we know by Axiom 8 that use(P, r, B) create(A) belongs to Th(G) and is thus satisfied by τ . Hence, τ also satisfies use(P, r, B) end(Q). s (9) ϕ is use(P, r, B) use(Q, s, A) with G (C, B, P, r) in G, Q → A in G, and either (a) A = C or (b) G A C. We already know from case 1 that τ satisfies create(C) create(A) for G A C (9B). If A = C (9A), then obviously τ (A) = τ (C), and τ still satisfies create(C) s create(A). For edge Q → A in G, we know by Axiom 3 that create(A) use(Q, s, A) belongs to Th(G) and is thus satisfied by τ . From G (C, B, P, r), we know by Axiom 8S that use(P, r, B) create(C) belongs to Th(G) and hence is satisfied by τ .

Therefore, we have use(P, r, B) create(C) create(A) use(Q, s, A). We conclude that τ also satisfies use(P, r, B) use(Q, s, A).

A.2. Proof of Completeness

Let G be a legal OPM graph, and let ϕ be a nontrivial inequality over the temporal variables of G such that Th(G) |= ϕ. We must show that ϕ ∈ Th(G) or that ϕ matches one of cases 1 through 9 of Theorem 4.7.

It is well known [Ullman 1989] that ϕ can be inferred from Th(G) by using repeated applications of the rule of transitivity: “from u v and v w infer u w.” We proceed by induction on the number of applications of the transitivity rule.

If ϕ can be inferred by zero applications, then ϕ is already in Th(G) and we are done, as this corresponds to case 0 of the theorem.

Now consider an application of transitivity inferring ϕ of the form u w from u v w, where by induction the theorem can already be assumed to hold for the inequalities u v and v w. Since begin-variables (end-variables) never appear on the right-hand (left-hand) side of an inequality, v cannot be a begin-variable (end-variable).

That leaves us with two cases, with v being either a create- or a use-variable. v is a create-variable. Let v be a create-variable, say create(Av ). Let us list the possibilities for u and note the relevant properties: (a) u is also a create-variable, say create(Au). By induction, we know that the inequality u v either already belongs to Th(G), so there is an edge Av → Au in G (Axiom 4), or the inequality corresponds to case 1 of the theorem, and therefore G Av Au. In either case, we have G Av Au. (b) u is a begin-variable, say begin(Pu). By induction, u v either belongs to Th(G), ! so there is an edge Av → Pu in G (Axiom 2) or Av → Pu in G (Axiom 5), or u v corresponds to case 2 of the theorem, and therefore G Av Pu. In either case, we have G Av Pu. (c) u is a use-variable, say use(Pu, ru, Au). By induction, u v either (c1) belongs to Th(G), so there is some use–generate–derive triangle (Av , Au, Pu, ru) in G (Axiom 8), or (c2) u v corresponds to case 7 of the theorem, and thus there is a use–generate– derive triangle (A v , Au, Pu, ru) in G with G Av A v .

We also list the possibilities for w and their relevant properties: (d) w is also a create-variable, say create(Aw ). By the induction hypothesis applied to v w, reasoning similarly as in the preceding case (a), we have G Aw Av . (e) w is an end-variable, say end(Pw ). By induction, v w either belongs to Th(G), so ! there is an edge Av → Pw in G (Axiom 2) or Pw → Av in G (Axiom 6), or v w corresponds to case 3 of the theorem, and therefore G Pw Av . Thus, we have ! either (e1) Av → Pw in G or (e2) G Pw Av .

ACM Transactions on the Web, Vol. 9, No. 2, Article 10, Publication date: May 2015.

10:40

N. Kwasnikowska et al.

Fig. 16. Proof of the completeness of Theorem 4.7 for cases c2 with e1 (a), c2 with e2 (b), h1 with l(c), and h2 with l(d). The bold edges are newly inferred.

(f) w is a use-variable, say use(Pw , rw , Aw ). This necessitates the presence of edge rw Pw → Aw in G. By induction, the inequality v w either (f1) belongs to Th(G), so Aw = Av (Axiom 3), or (f2) v w corresponds to case 5 of the theorem, and thus G Aw Av .

We can now inspect the nine possible combinations: (ad) ϕ is create(Au) create(Aw ). From G Av Au and G Aw Av , we infer G Aw Au, which matches case 1 of the theorem. ! (ae) ϕ is create(Au) end(Pw ). From G Av Au and either Av → Pw in G or G Pw Av , we infer G Pw Au, which matches case 3 of the theorem. rw (af) ϕ is create(Au) use(Pw , rw , Aw ) with Pw → Aw in G. In case f1, we have G Av Au and Av = Aw , so the case corresponds to case 5 of the theorem. In case f2, we infer G Aw Au from G Aw Av and G Av Au, which again matches case 5 of the theorem. (bd) ϕ is begin(Pu) create(Aw ). From G Av Pu and G Aw Av , we infer G Aw Pu, which corresponds to case 2 of the theorem. ! (be) ϕ is begin(Pu) end(Pw ). From G Av Pu and either Av → Pw in G or G Pw Av , we infer G Pw Pu, which matches case 4 of the theorem. rw (bf) ϕ is begin(Pu) use(Pw , rw , Aw ) with Pw → Aw in G. In case f1, we have G Av Pu and Av = Aw , so the case corresponds to case 6 of the theorem. In case f2, we infer G Aw Pu from G Aw Av and G Av Pu, which again matches case 6 of the theorem. (cd) ϕ is use(Pu, ru, Au) create(Aw ). Case c1 corresponds directly to case 7 of the theorem. In case c2, we infer G Aw A v from G Av A v and G Aw Av , which again matches case 7 of the theorem. (ce) ϕ is use(Pu, ru, Au) end(Pw ). First, consider case c1 together with e1. Since G (Av , Au, Pu, ru), Pu and Pw must be equal because G is legal. In this case, the inequality holds by Axiom 3. Case c1 together with e2 corresponds directly to ! case 8 of the theorem. Finally, in case c2, from G Av A v , and either Av → Pw (from e1, see Figure 16(a)) or G Pw Av (from e2, see Figure 16(b)), we infer G Pw A v , which matches case 8 of the theorem.

ACM Transactions on the Web, Vol. 9, No. 2, Article 10, Publication date: May 2015.

A Formal Account of the Open Provenance Model

10:41

(cf) ϕ is use(Pu, ru, Au) use(Pw , rw , Aw ). Case c1 together with f1 corresponds directly to case 9a of the theorem. Case c1 together with f2 matches case 9b of the theorem.

The same holds for c2 together with f1. In case c2 together with f2, we infer G Aw A v from G Aw Av and G Av A v , which again matches case 9 b of the theorem. v is a use-variable. Let v be a use-variable, say use(Pv , rv , Av ). Note that this necessirv tates the presence of the edge Pv → Av in G. Let us list the possibilities for u and note the relevant properties: (g) u is a create-variable, say create(Au). By induction, we know that the inequality rv u v either (g1) already belongs to Th(G), so Au equals Av with the edge Pv → Av in G (Axiom 3), or (g2) the inequality corresponds to case 5 of the theorem, and rv therefore G Av Au with the edge Pv → Av in G. (h) u is a begin-variable, say begin(Pu). By induction, u v either (h1) already belongs rv to Th(G), and thus Pu equals Pv with the edge Pv → Av in G (Axiom 3), or (h2) the inequality corresponds to case 6 of the theorem, and therefore G Av Pu with rv the edge Pv → Av in G. (i) u is also a use-variable, say use(Pu, ru, Au). By induction, we know that the inequality u v can only correspond to case 9 of the theorem, and therefore we have some rv triangle (A v , Au, Pu, ru) in G with the edge Pv → Av in G, and either Av = A v or

G Av Av .

We also list the possibilities for w and their relevant properties: (j) w is a create-variable, say create(Aw ). By induction, v w either (j1) already belongs to Th(G), so there is some use–generate–derive triangle (Aw , Av , Pv , rv ) in G (Axiom 8), or (j2) the inequality corresponds to case 7 of the theorem, and there is a use–generate–derive triangle (A w , Av , Pv , rv ) in G with G Aw A w . Note that in both cases, we can infer G Aw Av . Indeed, in case j1, we have the edge rv rv Aw → Av in G. In case j2, we have G Aw A w and the edge A w → Av in G. (k) w is an end-variable, say end(Pw ). By induction, v w either (k1) already belongs to rv Th(G), so Pw equals Pv with the edge Pv → Av in G (Axiom 3), or (k2) corresponds to case 8 of the theorem, and thus there is some use–generate–derive triangle (Aw , Av , Pv , rv ) in G with G Pw Aw . Note that in both cases, we can infer rv G Pw Av . Indeed, in case k1, we have the edge Pw → Av in G. In case k2, we rv have G Pw Aw and the edge Aw → Av in G. (l) w is also a use-variable, say use(Pw , rw , Aw ). By induction, we know that the inequality v w can only correspond to case 9 of the theorem, so there is some rw use–generate–derive triangle (A w , Av , Pv , rv ) in G with Pw → Aw in G, and either Aw = A w or G Aw A w . Note that in both cases, we can infer G Aw Av by rv the edge A w → Av in the triangle.

We can now inspect the nine possible combinations: (gj) ϕ is create(Au) create(Aw ). In case g1, we have G Aw Av and Av = Au, so the case corresponds directly to case 1 of the theorem. In case g2, we have G Aw Av and G Av Au, so we can infer G Aw Au, which, again, matches case 1 of the theorem. (gk) ϕ is create(Au) end(Pw ). In case g1 together with k1, we have Av = Au, Pv = Pw , rv and the edge Pv → Av in G, so the case corresponds directly to case 3 of the ACM Transactions on the Web, Vol. 9, No. 2, Article 10, Publication date: May 2015.

10:42

N. Kwasnikowska et al. rv

(gl)

(hj)

(hk)

(hl)

(ij) (ik)

(il)

theorem. In case g2 together with k1, we have Pv = Pw with the edge Pv → Av in G. From the latter and G Av Au, we infer G Pw Au, which again matches case 3 of the theorem. In case g1 together with k2, we have G Pw Av and Av = Au, so the case corresponds directly to case 3 of the theorem. In case g2 together with k2, we infer G Pw Au from G Pw Av and G Av Au. Hence, the case again matches case 3 of the theorem. ϕ is create(Au) use(Pw , rw , Aw ). In case g1, we have G Aw Av and Av = Au, so the case corresponds directly to case 5 of the theorem. In case g2, we infer G Aw Au from G Aw Av and G Av Au, which matches case 5 of the theorem. ϕ is begin(Pu) create(Aw ). By case 10, we infer G Aw Pv . (Indeed, in case j1, we easily infer G Aw Pv . In case j2, we also infer G Aw Pv from !

G Aw A w and A w → Pv in G.) Now, in case h1, we have Pv = Pu, so the case corresponds directly to case 2 of the theorem. In case h2, we have G Aw Av and G Av Pu, so we can infer G Aw Pu. Thus, the case again matches case 2 of the theorem. ϕ is begin(Pu) end(Pw ). In case h1 together with k1, we have Pu = Pv = Pw , so the inequality trivially holds (Axiom 1). In case h1 together with k2, we have Pv = Pu, and we infer G Pw Pv from G Pw Aw and G Aw Pv . Thus, the case corresponds to case 4 of the theorem. In case h2, we have G Pw Av , which combined with G Av Pu yields G Pw Pu. Hence, the case again matches case 4 of the theorem. ! ϕ is begin(Pu) use(Pw , rw , Aw ). By case 1, we infer G Aw Pv from A w → Pv rw in G, and either Aw = A w or G Aw A w . In addition, there is an edge Pw → Aw in G, and G Aw Av . In case h1 (see Figure 16(c)), we have Pv = Pu, so the case corresponds to case 6 of the theorem. In case h2 (see Figure 16(d)), from G Aw Av and G Av Pu, we infer G Aw Pu. Hence, the case again matches case 6 of the theorem. ϕ is use(Pu, ru, Au) create(Aw ). We infer G Aw A v from G Aw Av , and either Av = A v or G Av A v . Together with G (A v , Au, Pu, ru), the case corresponds to case 7 of the theorem. ϕ is use(Pu, ru, Au) end(Pw ). We already have G (A v , Au, Pu, ru). In case k1, we rv have Pw = Pv . We infer G Pv A v from the edge Pv → Av in G, and either Av = A v or G Av A v . The case thus matches case 8 of the theorem. In case rv k2, we infer G Pw A v from G Pw Aw , Aw → Av in G, and either Av = A v

or G Av Av . Hence, the case again matches case 8 of the theorem. rw ϕ is use(Pu, ru, Au) use(Pw , rw , Aw ). We already have Pw → Aw in G and G

(Av , Au, Pu, ru). We additionally infer G Aw Av from G Aw Av , and either Av = A v or G Av A v . Hence, the case matches case 9b of the theorem.

REFERENCES Peter Buneman, James Cheney, Wang-Chiew Tan, and Stijn Vansummeren. 2008. Curated databases. In Proceedings of the 27th ACM SIGMOD-SIGACT-SIGART Symposium on Principles of Database Systems (PODS’08). ACM, New York, NY, 1–12. DOI:http://dx.doi.org/10.1145/1376916.1376918 James Cheney. 2010. Causality and the semantics of provenance. In Proceedings of the 6th Workshop on Developments in Computational Models (EPTCS’10). 63–74.

James Cheney. 2013. Semantics of the PROV Data Model. W3C Working Draft WD-prov-sem-20130312.

World Wide Web Consortium.

James Cheney, Laura Chiticarius, and Wang-Chiew Tan. 2009. Provenance in databases: Why, how, and where. Foundations and Trends in Databases 1, 4, 379–474.

ACM Transactions on the Web, Vol. 9, No. 2, Article 10, Publication date: May 2015.

A Formal Account of the Open Provenance Model

10:43

James Cheney, Paolo Missier, Luc Moreau, and Tom De Nies (Eds.). 2013. Constraints of the PROV Data Model. W3C Recommendation REC-prov-constraints-20130430. World Wide Web Consortium. http://www.w3.org/TR/2013/REC-prov-constraints-20130430/. ¨ Saumen Dey, Sean Riddle, and Bertram Ludascher.

2013. Provenance analyzer: Exploring provenance semantics with logic rules. In Poceedings of the 5th USENIX Workshop on the Theory and Practice of Provenance. https://www.usenix.org/conference/tapp13/provenance-analyzer.

Li Ding, James Michaelis, Jim McCusker, and Deborah L. McGuinness. 2011. Linked provenance data: A Semantic Web-based approach to interoperable workflow traces. Future Generation Computer Systems 27, 6, 797–805.

Andre Freitas, Sean O’Riain, Edward Curry, and Tomas Knap. 2011. W3P: Building an OPM based provenance model for the Web. Future Generation Computer Systems 27, 6, 766–774.

Yolanda Gil, James Cheney, Paul Groth, Olaf Hartig, Simon Miles, Luc Moreau, Paulo Pinheiro da Silva, Sam Coppens, Daniel Garijo, Jose Manuel Gomez, Paolo Missier, Satya Sahoo, and Jun Zhao (Eds.).

2010. Provenance XG Final Report. W3C Incubator Group Report XGR-prov-20101214. World Wide Web Consortium. http://www.w3.org/2005/Incubator/prov/XGR-prov-20101214/.

Paul Groth and Luc Moreau. 2011. Representing distributed systems using OPM. Future Generation Computer Systems 26, 6, 757–765.

Joseph Y. Halpern and Judea Pearl. 2005. Causes and explanations: A structural-model approach. Part I: Causes. British Journal for the Philosophy of Science 56, 4, 843–887.

Richard Hull and Masatoshi Yoshikawa. 1990. ILOG: Declarative creation and manipulation of object identifiers. In Proceedings of the 16th International Conference on Very Large Data Bases. 455–468.

Ian Jacobs and Norman Walsh. 2004. Architecture of the World Wide Web, Volume One. W3C Recommendation 15 December 2004. Retrieved April 21, 2015, from http://www.w3.org/TR/webarch/.

Natalia Kwasnikowska, Luc Moreau, and Jan Van den Bussche. 2010. A Formal Account of the Open Provenance Model. eprint 271819. University of Southampton.

Natalia Kwasnikowska and Jan Van den Bussche. 2008. Mapping the NRC dataflow model to the open provenance model. In Provenance and Annotation of Data and Processes. Lecture Notes in Computer Science, Vol. 5272. Springer, 3–16.

Leslie Lamport. 1978. Time, clocks, and the ordering of events in a distributed system. Communications of the ACM 21, 7, 558–565.

Chunhyeok Lim, Shiyong Lu, Artem Chebotko, and Farshad Fotouhi. 2011. Storing, reasoning, and querying OPM-compliant scientific workflow provenance using relational databases. Future Generation Computer Systems 27, 6, 781–789.

Friedemann Mattern. 1989. Virtual time and global states of distributed systems. In Proceedings of the International Workshop on Parallel and Distributed Algorithms. 215–226.

Robert E. McGrath and Joe Futrelle. 2008. Reasoning about provenance with OWL and SWRL rules. In Proceedings of the AAAI Spring Symposium: AI Meets Business Rules and Process Management. 87–92.

Simon Miles. 2011. Mapping attribution metadata to the open provenance model. Future Generation Computer Systems 27, 6, 806–811.

Simon Miles, Paul Groth, Miguel Branco, and Luc Moreau. 2007. The requirements of using provenance in e-Science experiments. Journal of Grid Computing 5, 1, 1–25.

Paolo Missier, Bertram Ludascher, Shawn Bowers, Saumen Dey, Anandarup Sarkar, Biva Shrestha, Ilkay Altintas, Manish K. Anand, and Carole Goble. 2010. Linking multiple workflow provenance traces for interoperable collaborative science. In Proceedings 5th Workshop on Workflows in Support of Large-Scale Science. IEEE, Los Alamitos, CA, 1–8.

Paolo Missier and Carole Goble. 2011. Workflows to open provenance graphs, round-trip. Future Generation Computer Systems 27, 6, 812–819.

Luc Moreau. 2010a. Provenance-based reproducibility in the semantic Web. Journal of Web Semantics 9, 2, 202–221.

Luc Moreau. 2010b. The foundations for provenance on the Web. Foundations and Trends in Web Science 2, 2-3, 99–241.

Luc Moreau, Ben Clifford, Juliana Freire, Joe Futrelle, Yolanda Gil, Paul Groth, Natalia Kwasnikowska, Simon Miles, Paolo Missier, Jim Myers, Beth Plale, Yogesh Simmhan, Eric Stephan, and Jan Van den Bussche. 2011. The open provenance model core specification (v1.1). Future Generation Computer Systems 27, 6, 743–756.

Luc Moreau, Li Ding, Joe Futrelle, Daniel Garijo Verdejo, Paul Groth, Mike Jewell, Simon Miles, Paolo Missier, Jeff Pan, and Jun Zhao. 2010. Open Provenance Model (OPM) OWL Specification. Retrieved April 21, 2015, from http://openprovenance.org/model/opmo.

ACM Transactions on the Web, Vol. 9, No. 2, Article 10, Publication date: May 2015.

10:44

N. Kwasnikowska et al.

Luc Moreau, Trung Dong Huynh, and Danius Michaelides. 2014. An online validator for provenance: Algorithmic design, testing, and API. In Fundamental Approaches to Software Engineering. Lecture Notes in Computer Science, Vol. 8411. Springer, 291–305. http://eprints.soton.ac.uk/340068/.

Luc Moreau, Paolo Missier, Khalid Belhajjame, Reza B’Far, James Cheney, Sam Coppens, Stephen Cresswell, Yolanda Gil, Paul Groth, Graham Klyne, Timothy Lebo, Jim McCusker, Simon Miles, James Myers, Satya Sahoo, and Curt Tilmes (Eds.). 2013. PROV-DM: The PROV Data Model. W3C Recommendation RECprov-dm-20130430. World Wide Web Consortium. http://www.w3.org/TR/2013/REC-prov-dm-20130430/.

James Myers. 2010. I think therefore I am someone else: Understanding the confusion of granularity with continuant/occurrent and related perspective shifts. In Provenance and Annotation of Data and Processes. Lecture Notes in Computer Science, Vol. 6378. Springer, 292–294.

Satya Sahoo, Paul Groth, Olaf Hartig, Simon Miles, Sam Coppens, James Myers, Yolanda Gil, Luc Moreau, Jun Zhao, Michael Panzer, and Daniel Garijo. 2010. Provenance Vocabulary Mappings. Technical Report.

W3C. Available at http://www.w3.org/2005/Incubator/prov/wiki/Provenance_Vocabulary_Mappings.

Yogesh L. Simmhan, Beth Plale, and Dennis Gannon. 2005. A survey of data provenance in e-Science. ACM SIGMOD Record 34, 3, 31–36. DOI:http://dx.doi.org/10.1145/1084805.1084812 Alfred Tarski. 1986. What are logical notions? History and Philosophy of Logic 7, 2, 143–154.

Gerard Tel. 1994. Introduction to Distributed Algorithms. Cambridge University Press.

Curt Tilmes, Peter Fox, Xiaogang Ma, Deborah L. McGuinness, Ana Pinheiro Privette, Aaron Smith, Anne Waple, Stephan Zednik, and Jin Guang Zheng. 2013. Provenance representation for the national climate assessment in the global change information system. IEEE Transactions on Geoscience and Remote Sensing 51, 1, 5160–5168.

Jeffrey D. Ullman. 1989. Principles of Database and Knowledge-Base Systems. Vol. II. Computer Science Press.

W3C PROV. 2011. W3C Provenance Working Group Activity. Retrieved April 21, 2015, from http://www.w3.org/2011/prov/.

W3C Provenance Incubator Activity. 2010. Provenance Incubator Group Charter. Retrieved April 21, 2015, from http://www.w3.org/2005/Incubator/prov/charter.

Jim Woodcock and Jim Davies. 1996. Using Z. Specification, Refinement, and Proof . Prentice Hall.

Received March 2012; revised November 2014; accepted February 2015

ACM Transactions on the Web, Vol. 9, No. 2, Article 10, Publication date: May 2015.